CVE-2013-3678 - Vulnerability Details - OpenCVE

Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sap	Governance Risk And Compliance

Configuration 1 [-]

cpe:2.3:a:sap:governance_risk_and_compliance:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html
http://seclists.org/fulldisclosure/2014/Nov/25
http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control
http://www.securityfocus.com/archive/1/533965/100/0/threaded
http://www.securityfocus.com/bid/71055
https://exchange.xforce.ibmcloud.com/vulnerabilities/98637
https://service.sap.com/sap/support/notes/2039348

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2014-11-17T16:00:00

Updated: 2024-08-06T16:14:56.568Z

Reserved: 2013-05-24T00:00:00

Link: CVE-2013-3678

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-11-19T02:59:00.083

Modified: 2025-04-12T10:46:40.837

Link: CVE-2013-3678

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-11-11T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "71055", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71055"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "https://service.sap.com/sap/support/notes/2039348"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"name": "sapgrc-cve20133678-priv-esc(98637)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"tags": ["x_refsource_MISC"], "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-3678", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "71055", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71055"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"name": "https://service.sap.com/sap/support/notes/2039348", "refsource": "MISC", "url": "https://service.sap.com/sap/support/notes/2039348"}, {"name": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"name": "sapgrc-cve20133678-priv-esc(98637)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"name": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control", "refsource": "MISC", "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:14:56.568Z"}, "title": "CVE Program Container", "references": [{"name": "71055", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71055"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://service.sap.com/sap/support/notes/2039348"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"name": "sapgrc-cve20133678-priv-esc(98637)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-3678", "datePublished": "2014-11-17T16:00:00", "dateReserved": "2013-05-24T00:00:00", "dateUpdated": "2024-08-06T16:14:56.568Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:governance_risk_and_compliance:-:*:*:*:*:*:*:*", "matchCriteriaId": "0529FFF1-8541-498C-ABED-F38A142D4D0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades sin especificar en SAP Governance, Risk, and Compliance(GRC), permiten a usuarios remotos autenticados ganar privilegios y ejecutar programas arbitrarios a trav\u00e9s de una solicitud (1) RFC o (2) SOAP-RFC manipulada."}], "id": "CVE-2013-3678", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-11-19T02:59:00.083", "references": [{"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}, {"source": "cve@mitre.org", "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/71055"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"source": "cve@mitre.org", "url": "https://service.sap.com/sap/support/notes/2039348"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/71055"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://service.sap.com/sap/support/notes/2039348"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}