SAP NetWeaver Process Integration (PI) contains a flaw that is triggered when an error occurs in the PI SDK XML parser during the validation of incoming XML requests with user-supplied Document Type Definition (DTD). This may allow a remote attacker to execute arbitrary administrator commands and execute XXE tunneling via a gopher scheme.

The vendor has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section. There are no known workarounds or upgrades to correct this issue.

• Secunia Advisory ID: 51152
• Other Advisory URL: http://erpscan.com/advisories/dsecrg-12-038-sap-netweaver-pi-sdk-xxe-and-xxe-tunneling/
• Vendor URL: http://www.sap.com/index.epx/
• Vendor Specific Advisory URL: https://service.sap.com/sap/support/notes/1723641 [ Auth Req'd ]

• Alexander Polyakov - ERPScan
• Alexey Tyurin - ERPScan
• Alexandr Minozhenko - ERPScan

NVD does not currently have a CVSSv2 score assigned.