CVE-2015-2812

Related Files

SAP NetWeaver Portal 7.31 XXE Injection

Posted Jun 18, 2015

Authored by Vahagn Vardanyan

SAP NetWeaver Portal version 7.31 suffers from an XXE injection vulnerability. The problem is caused by a program error in 'ValidationComponent' due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering the application content temporarily unavailable.

tags | advisory, denial of service, xxe

advisories | CVE-2015-2812

SHA-256 | 9756bc993b8745281faa7c356860f96edc0f791cd1ec7201932b24da9da7b059

Download | Favorite | View