CVE-2014-3133

SAP NetWeaver Java Application Server - Unauthenticated Information Disclosure via SystemSelection WebDynpro

Title source: llm
STIX 2.1

Description

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection.

References (5)

Core 5
Core References
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/301
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/67104
Various Sources x_refsource_confirm
http://scn.sap.com/docs/DOC-8218
Various Sources x_refsource_confirm
https://service.sap.com/sap/support/notes/1922547

Scores

EPSS 0.0035
EPSS Percentile 57.8%

Details

CWE
CWE-264
Status published
Products (1)
sap/netweaver_java_application_server
Published Apr 30, 2014
Tracked Since Feb 18, 2026