{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Web Application Server 6.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Web Application Server 7.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Enterprise Portal 6.x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver 7.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDeux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans diff\u00e9rents produits SAP.\n\nLa premi\u00e8re permet \u00e0 une personne malintentionn\u00e9e d\u0027injecter du code \u00e0\ndistance. Elle concerne les produits SAP NetWeaver 7.X et SAP Web\nApplication Server 6.x et 7.x. Elle touche les modules ITS Mobile Start\net ITS Mobile Test qui ne g\u00e8rent pas correctement certaines entr\u00e9es.\n\nLa seconde permet \u00e0 une personne malintentionn\u00e9e d\u0027obtenir certaines\ninformations sensibles. Elle touche les produits SAP Enterprise Portal\n6.x et SAP Netweaver 7.x. Cette vuln\u00e9rabilit\u00e9 concerne l\u0027affichage de\nmessages d\u0027erreur pouvant contenir le chemin d\u0027installation complet du\nmodule fautif. Elle est d\u00e9clench\u00e9e suite \u00e0 la r\u00e9ception de requ\u00eates HTTP\nsp\u00e9cialement con\u00e7ues.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2011-04-19T00:00:00",
  "last_revision_date": "2011-04-19T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 1513182",
      "url": "https://service.sap.com/sap/support/notes/1513182"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 1512134:",
      "url": "https://service.sap.com/sap/support/notes/1512134"
    }
  ],
  "reference": "CERTA-2011-AVI-233",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-04-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Des vuln\u00e9rabilit\u00e9s permettant une injection indirecte de code \u00e0 distance\net une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es ont \u00e9t\u00e9 d\u00e9couvertes\ndans plusieurs produits \u003cspan class=\"textit\"\u003eSAP\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SAP NetWeaver, SAP Web Application Server et SAP Enterprise Portal",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 1512134 et 1513182",
      "url": null
    }
  ]
}