Login Request a demo
Unscored severity · published Apr 1, 2015
CVE-2015-2813
XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358
–
CVSS
1.6%
EPSS
No
On KEV
Description
XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Mobile Platform · Sap
All versions, or not specified · source: NVD
Affected product
MP
Mobile Platform
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2813
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2813
packetstormsecurity.com
http://packetstormsecurity.com/files/132357/SAP-Mobile-Platform-2.3-XXE-Injection.html
seclists.org
http://seclists.org/fulldisclosure/2015/Jun/63
www.securityfocus.com
http://www.securityfocus.com/archive/1/535828/100/800/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/73692
erpscan.io
https://erpscan.io/advisories/erpscan-15-005-sap-mobile-platform-xxe/
More from Mobile Platform
7.5
CVE-2018-2459
Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data…
5.5
CVE-2015-7731
SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830
4.3
CVE-2020-6177
SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service
–
CVE-2015-8600
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other…
–
CVE-2015-6664
XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other…