CVEvulnerability
CVE-2016-9832
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2016-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.9 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-74
Description
PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report.
Affected configurations
• pwc ace-advanced business application programming 8.10.304
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/33 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/539883/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/539883/30/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/94733 Third Party Advisory, VDB Entry
- https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security Permissions Required
- http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/33 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/539883/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/539883/30/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/94733 Third Party Advisory, VDB Entry
- https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security Permissions Required