Vulnerability Description
The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver Application Server Java | - |
Related Weaknesses (CWE)
References
- http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-20Broken Link
- https://erpscan.io/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauThird Party Advisory
- http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-20Broken Link
- https://erpscan.io/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauThird Party Advisory
FAQ
What is CVE-2015-8840?
CVE-2015-8840 is a vulnerability with a CVSS score of 8.8 (HIGH). The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly ha...
How severe is CVE-2015-8840?
CVE-2015-8840 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-8840?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Netweaver Application Server Java.