CVE-2013-3678 - Vulnerability Details - OpenCVE

Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.02173.

Key SSVC decision points have not yet been added.

Vendors	Products
Sap Subscribe	Governance Risk And Compliance Subscribe

Configuration 1 [-]

cpe:2.3:a:sap:governance_risk_and_compliance:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2013-3611	Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html
http://seclists.org/fulldisclosure/2014/Nov/25
http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control
http://www.securityfocus.com/archive/1/533965/100/0/threaded
http://www.securityfocus.com/bid/71055
https://exchange.xforce.ibmcloud.com/vulnerabilities/98637
https://service.sap.com/sap/support/notes/2039348

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2014-11-17T16:00:00

Updated: 2024-08-06T16:14:56.568Z

Reserved: 2013-05-24T00:00:00

Link: CVE-2013-3678

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-11-19T02:59:00.083

Modified: 2025-04-12T10:46:40.837

Link: CVE-2013-3678

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-11-11T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "71055", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71055"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "https://service.sap.com/sap/support/notes/2039348"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"name": "sapgrc-cve20133678-priv-esc(98637)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"tags": ["x_refsource_MISC"], "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-3678", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "71055", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71055"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"name": "https://service.sap.com/sap/support/notes/2039348", "refsource": "MISC", "url": "https://service.sap.com/sap/support/notes/2039348"}, {"name": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"name": "sapgrc-cve20133678-priv-esc(98637)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"name": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control", "refsource": "MISC", "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:14:56.568Z"}, "title": "CVE Program Container", "references": [{"name": "71055", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71055"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://service.sap.com/sap/support/notes/2039348"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"name": "sapgrc-cve20133678-priv-esc(98637)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"name": "20141112 [ESNC-2039348] Multiple Critical Security Vulnerabilities in SAP Governance, Risk and Compliance (SAP GRC)", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-3678", "datePublished": "2014-11-17T16:00:00", "dateReserved": "2013-05-24T00:00:00", "dateUpdated": "2024-08-06T16:14:56.568Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:governance_risk_and_compliance:-:*:*:*:*:*:*:*", "matchCriteriaId": "0529FFF1-8541-498C-ABED-F38A142D4D0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades sin especificar en SAP Governance, Risk, and Compliance(GRC), permiten a usuarios remotos autenticados ganar privilegios y ejecutar programas arbitrarios a trav\u00e9s de una solicitud (1) RFC o (2) SOAP-RFC manipulada."}], "id": "CVE-2013-3678", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-11-19T02:59:00.083", "references": [{"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}, {"source": "cve@mitre.org", "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/71055"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"source": "cve@mitre.org", "url": "https://service.sap.com/sap/support/notes/2039348"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2014/Nov/25"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/533965/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/71055"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98637"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://service.sap.com/sap/support/notes/2039348"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}