| Title | SAP NetWeaver AS for JAVA における XML 外部エンティティの脆弱性 |
|---|---|
| Summary | SAP NetWeaver AS for JAVA には、XML 外部エンティティの脆弱性が存在します。 |
| Possible impacts | 情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | June 8, 2021, midnight |
| Registration Date | Feb. 25, 2022, 6 p.m. |
| Last Update | Feb. 25, 2022, 6 p.m. |
| CVSS3.0 : 警告 | |
| Score | 6.5 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H |
| CVSS2.0 : 警告 | |
| Score | 5.5 |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:N/A:P |
| SAP |
| SAP Netweaver Application Server Java 7.20 |
| SAP Netweaver Application Server Java 7.30 |
| SAP Netweaver Application Server Java 7.31 |
| SAP Netweaver Application Server Java 7.40 |
| SAP Netweaver Application Server Java 7.50 |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2022年02月25日] 掲載 |
Feb. 25, 2022, 6 p.m. |
| Summary | SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation, this vulnerability enables attacker to fully compromise confidentiality by allowing them to read any file on the filesystem or fully compromise availability by causing the system to crash. The attack cannot be used to change any data so that there is no compromise as to integrity. |
|---|---|
| Publication Date | June 9, 2021, 11:15 p.m. |
| Registration Date | June 10, 2021, 10 a.m. |
| Last Update | Nov. 21, 2024, 2:58 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:sap:netweaver_application_server_for_java:7.20:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:netweaver_application_server_for_java:7.30:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:netweaver_application_server_for_java:7.31:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:netweaver_application_server_for_java:7.40:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:sap:netweaver_application_server_for_java:7.50:*:*:*:*:*:*:* | |||||