CVE-2008-4830 Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitra...
HighCVSS 9.3
EPSS 27.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files via the OpenDocument method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap gui | = 6.40 | No fix listed |
| sap gui | = 7.10 | No fix listed |
References
- 32869 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- 20090415 Secunia Research: SAP GUI KWEdit ActiveX Control "SaveDocumentAs()" Insecure Method mailing-list
- 34524 vdb-entry
- 1022062 vdb-entry
- ADV-2009-1043 patch vdb-entry vendor-advisory