Unscored severity · published Apr 30, 2014
CVE-2014-3133
SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified…
–
CVSS
2.1%
EPSS
No
On KEV
Description
SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NJ
Netweaver Java Application Server · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3133
scn.sap.com
http://scn.sap.com/docs/DOC-8218
seclists.org
http://seclists.org/fulldisclosure/2014/Apr/301
www.onapsis.com
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008
www.securityfocus.com
http://www.securityfocus.com/bid/67104
service.sap.com
https://service.sap.com/sap/support/notes/1922547
More from Netweaver Java Application Server
–
CVE-2015-4158
SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661
–
CVE-2015-2282
Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server…
–
CVE-2015-2278
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application…
–
CVE-2014-8590
XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted…