CVE-2015-8840

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

1.31%

Published

Apr 7, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-862

Affected Products (1)

sap · netweaver_application_server_javavulnerable

References (4)

http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015

Broken Link

https://erpscan.io/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauthorized-access/

Third Party Advisory

http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015

Broken Link

https://erpscan.io/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauthorized-access/

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs