CVE-2014-8590
CVE-2014-8590 is a medium-severity vulnerability in Sap Netweaver Java Application Server with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.3)
- EPSS exploit prediction: 2% (80th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Sap Netweaver Java Application Server
- Published:
- Last modified:
Description
XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted request.
Frequently asked questions
- What is CVE-2014-8590?
- XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted request.
- How severe is CVE-2014-8590?
- CVE-2014-8590 has a CVSS 2.0 base score of 4.3, rated medium severity.
- Is CVE-2014-8590 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-8590?
- CVE-2014-8590 affects Sap Netweaver Java Application Server. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2014-8590?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-8590 published?
- CVE-2014-8590 was published on 2014-11-04 and last updated on 2026-06-17.
References
- http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
- http://www.securityfocus.com/bid/71023
- https://erpscan.io/advisories/erpscan-14-015-sap-netweaver-as-java-xxe/
- https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98581
- https://service.sap.com/sap/support/notes/2045176
Affected products (1)
- cpe:2.3:a:sap:netweaver_java_application_server:-:*:*:*:*:*:*:*
More vulnerabilities in Sap Netweaver Java Application Server
- CVE-2015-2282 — High (CVSS 7.5): Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in…
- CVE-2015-4158 — Medium (CVSS 5.0): SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified…
- CVE-2015-2278 — Medium (CVSS 5.0): The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6,…
- CVE-2014-3133 — Medium (CVSS 5.0): SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the…