CVE-2015-6664

Severity

68%

Complexity

86%

Confidentiality

106%

CWE-611: Improper Restriction of XML External Entity Reference ('XXE')

XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227.

CWE-611: Improper Restriction of XML External Entity Reference ('XXE')

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

First reported 9 years ago

2015-08-24 14:59:00

Last updated 6 years ago

2018-12-10 19:29:00

Affected Software

SAP Mobile Platform 2.3

2.3

References

http://packetstormsecurity.com/files/134509/SAP-Mobile-Platform-2.3-XXE-Injection.html

20151124 [ERPSCAN-15-020] SAP Mobile Platform 2.3 - XXE in application import

20151123 [ERPSCAN-15-020] SAP Mobile Platform 2.3 - XXE in application import

https://erpscan.io/advisories/erpscan-15-020-sap-mobile-platform-2-3-xxe-in-application-import/

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.