ID CVE-2006-6010
Summary SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.
References
Vulnerable Configurations
  • cpe:2.3:a:sap:sap_web_application_server
    cpe:2.3:a:sap:sap_web_application_server
CVSS
Base: 5.0 (as of 22-11-2006 - 12:36)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
metasploit via4
description This module makes use of the RFC_SYSTEM_INFO Function to obtain the operating system version, SAP version, IP address and other information through the use of the /sap/bc/soap/rfc SOAP service.
id MSF:AUXILIARY/SCANNER/SAP/SAP_SOAP_RFC_SYSTEM_INFO
last seen 2019-03-29
modified 2017-07-24
published 2012-11-07
reliability Normal
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_soap_rfc_system_info.rb
title SAP /sap/bc/soap/rfc SOAP Service RFC_SYSTEM_INFO Function Sensitive Information Gathering
refmap via4
bugtraq 20061112 Old SAP exploits
sreason 1889
xf netweaver-rfcsysteminfo-info-disclosure(39997)
Last major update 05-09-2008 - 17:13
Published 21-11-2006 - 18:07
Last modified 17-10-2018 - 17:46
Back to Top