CVE-2015-2811

EUVD-2015-2899
XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2111939.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
Affected Products (NVD)
VendorProductVersion
sapnetweaver_enterprise_portal
7.31
𝑥
= Vulnerable software versions
References
http://packetstormsecurity.com/files/132358/SAP-NetWeaver-Portal-7.31-XXE-Injection.html
http://seclists.org/fulldisclosure/2015/Jun/64
http://www.securityfocus.com/archive/1/535827/100/800/threaded
http://www.securityfocus.com/bid/73691
https://erpscan.io/advisories/erpscan-15-006-sap-netweaver-portal-reportxmlviewer-xxe/
http://packetstormsecurity.com/files/132358/SAP-NetWeaver-Portal-7.31-XXE-Injection.html
http://seclists.org/fulldisclosure/2015/Jun/64
http://www.securityfocus.com/archive/1/535827/100/800/threaded
http://www.securityfocus.com/bid/73691
https://erpscan.io/advisories/erpscan-15-006-sap-netweaver-portal-reportxmlviewer-xxe/