CVE-2015-7241
CriticalSummary
The XXE vulnerability in SAP Netweaver before version 7.01 allows an attacker to exploit external XML entities to gain access to system data.
Risk Assessment
The organization may be exposed to sensitive data disclosure and attacks on system infrastructure.
Recommendation
It is recommended to upgrade SAP Netweaver to version 7.01 or later to mitigate this vulnerability.
Other vulnerabilities in SAP Netweaver
See all- CVE-2017-9845High
Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.
- CVE-2016-3635High
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
- CVE-2015-5067High
The Cross-System Tools and Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
- CVE-2014-4003High
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
- CVE-2016-10311Critical
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
- CVE-2026-76963Medium
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. This could expose security-relevant settings and internal system details, with low impact on confidentiality while integrity and availability remain unaffected.
- CVE-2026-58246Medium
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.
Original NVD description (English source)
XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.