« Volver al listado

CVE-2013-6815

Estado: ModificadaMedia (5)—

La función SHSTI_UPLOAD_XML en Application Server for ABAP (AS ABAP) de SAP NetWeaver 7.31 y anteriores permite a atacantes remotos provocar una denegación de servicio a través de vectores sin especificar, relacionado con un problema XML External Entity (XXE).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6815",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-11-20T14:12:30.913",
  "references": [
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/55620",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://erpscan.io/advisories/erpscan-13-020-sap-netweaver-shsti_upload_xml-xxe/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1890819",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/55620",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://erpscan.io/advisories/erpscan-13-020-sap-netweaver-shsti_upload_xml-xxe/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1890819",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue."
    },
    {
      "lang": "es",
      "value": "La función SHSTI_UPLOAD_XML en Application Server for ABAP (AS ABAP) de SAP NetWeaver 7.31 y anteriores permite a atacantes remotos provocar una denegación de servicio a través de vectores sin especificar, relacionado con un problema XML External Entity (XXE)."
    }
  ],
  "lastModified": "2026-06-17T00:00:58.933",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AAB3DAC-021F-4C9E-B46E-BD656C1AB629",
              "versionEndIncluding": "7.31"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F59EAE32-F443-490E-9213-596430E406E7"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A35F93E3-FC19-4A52-885A-AA2112CAF34D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41FAC5DD-D577-47F9-B0CA-006032256642"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:ehp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FC1767F-10BD-468B-8D2B-538C82EB69B2"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:ehp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D04DC424-129B-448D-994B-7AC5D9B64703"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:sp15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABEE6BE3-556F-4A1E-8FA3-CD5E5C1D42E9"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:sp8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73914503-E9AA-4382-85FC-B0DD45ABDD77"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2794A7DB-D5B8-467E-93F4-D65245FF187D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9805246-77E5-456C-B7CF-07CFF2F9F069"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "369D0212-65DA-4121-981B-1F07B7465F97"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDFFDB95-B956-4B22-81F4-A4074D49D4A8"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "606EFE4F-57A4-44E2-A98D-F0867A658218"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}