CVE-2017-11459

SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/
https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:trex:7.10:*:*:*:*:*:*:*

History

21 Nov 2024, 03:07

Type	Values Removed	Values Added
References	~~() https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/ -~~	() https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/ -

Information

Published : 2017-07-25 18:29

Updated : 2024-11-21 03:07

NVD link : CVE-2017-11459

Mitre link : CVE-2017-11459

CVE.ORG link : CVE-2017-11459

JSON object : View

Products Affected

sap

trex

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2017-11459", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-07-25T18:29:01.167", "references": [{"url": "https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/", "source": "cve@mitre.org"}, {"url": "https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592."}, {"lang": "es", "value": "SAP TREX versi\u00f3n 7.10 permite a los atacantes remotos (1) leer archivos arbitrarios mediante un comando fget o (2) escribir en archivos arbitrarios y, en consecuencia, ejecutar c\u00f3digo arbitrario mediante un comando fdir, tambi\u00e9n se conoce como Nota de Seguridad de SAP 2419592."}], "lastModified": "2024-11-21T03:07:49.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:trex:7.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "480E51C3-A029-44F2-9874-B9B551A225CE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}