CVE-2015-5067
HighSummary
The Cross-System Tools and Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
Risk Assessment
The presence of hardcoded credentials poses a significant security risk, enabling unauthorized access to system data and functions.
Recommendation
It is recommended to remove hardcoded credentials and implement more secure authentication methods in these components.
Other vulnerabilities in SAP NetWeaver
See all- CVE-2017-9845High
Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.
- CVE-2016-3635High
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
- CVE-2014-4003High
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
- CVE-2015-7241Critical
The XXE vulnerability in SAP Netweaver before version 7.01 allows an attacker to exploit external XML entities to gain access to system data.
- CVE-2016-10311Critical
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
- CVE-2026-58246Medium
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.
Original NVD description (English source)
The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.