« Volver al listado

CVE-2013-6244

Estado: ModificadaMedia (5)—

La aplicacione Live Update WebDynpro (WebDynpro / distribuidor / sap.com / tc ~ slm ~ ui_lup / LUP) en SAP NetWeaver 7.31 y anteriores permite a atacantes remotos leer archivos arbitrarios y directorios a través de un documento XML que contiene una declaración de entidad externa en combinación con un referencia de la entidad, en relación con una cuestión entidad externa XML (XXE).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6244",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-10-24T00:55:02.570",
  "references": [
    {
      "url": "http://en.securitylab.ru/lab/PT-2013-13",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/98892",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/55302",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/63302",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1820894",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://en.securitylab.ru/lab/PT-2013-13",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/98892",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/55302",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/63302",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1820894",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
    },
    {
      "lang": "es",
      "value": "La aplicacione Live Update  WebDynpro (WebDynpro / distribuidor / sap.com / tc ~ slm ~ ui_lup / LUP) en SAP NetWeaver 7.31 y anteriores permite a atacantes remotos leer archivos arbitrarios y directorios a través de un documento XML que contiene una declaración de entidad externa en combinación con un referencia de la entidad, en relación con una cuestión entidad externa XML (XXE).\n"
    }
  ],
  "lastModified": "2026-06-17T00:00:13.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AAB3DAC-021F-4C9E-B46E-BD656C1AB629",
              "versionEndIncluding": "7.31"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F59EAE32-F443-490E-9213-596430E406E7"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A35F93E3-FC19-4A52-885A-AA2112CAF34D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41FAC5DD-D577-47F9-B0CA-006032256642"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2794A7DB-D5B8-467E-93F4-D65245FF187D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9805246-77E5-456C-B7CF-07CFF2F9F069"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "369D0212-65DA-4121-981B-1F07B7465F97"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDFFDB95-B956-4B22-81F4-A4074D49D4A8"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "606EFE4F-57A4-44E2-A98D-F0867A658218"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}