NVD

Id
28874  
Name
CVE-2015-8840  
Description
The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-04-07  
Modified Date
2016-04-11  
Seq
2015-8840  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
152155 28874 CVE-2015-8840 http://erpscan.com/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauthorized-access/  View
152156 28874 CVE-2015-8840 http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11706 JVNDB-2015-007026 SAP NetWeaver AS Java の XML Data Archiving Service における重要な情報を取得される脆弱性 SAP NetWeaver AS Java の XML Data Archiving Service (XML DAS) は、認証をチェックしないため、重要な情報を取得される、権限を取得されるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2015-8840 86065 CVE-2015-8840 28874 6.5 6.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-007026.html 2015-07-15 2016-04-13 View