CVE-2017-5372

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the (1) getInformation, (2) getParameters, (3) getServiceInfo, (4) getStatistic, or (5) getClientStatistic function, aka SAP Security Note 2331908.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/140611/SAP-NetWeaver-AS-Java-P4-MSPRUNTIMEINTERFACE-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Jan/50Mailing List, VDB Entry
http://www.securityfocus.com/bid/93504Third Party Advisory, VDB Entry
https://erpscan.io/advisories/erpscan-16-037-sap-java-p4-mspruntimeinterface-information-disclosure/
https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-october-2016/
http://packetstormsecurity.com/files/140611/SAP-NetWeaver-AS-Java-P4-MSPRUNTIMEINTERFACE-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Jan/50Mailing List, VDB Entry
http://www.securityfocus.com/bid/93504Third Party Advisory, VDB Entry
https://erpscan.io/advisories/erpscan-16-037-sap-java-p4-mspruntimeinterface-information-disclosure/
https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-october-2016/

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-53739.8Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presum CVE-2017-53749.8Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough ef CVE-2017-53759.8JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability af CVE-2017-53769.8Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51 CVE-2017-53779.8A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable cra CVE-2017-53787.5Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered thr CVE-2017-53797.5Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Fire CVE-2017-53809.8A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Fire CVE-2017-53817.5The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slash CVE-2017-53827.5Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of intern CVE-2017-53835.3URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name CVE-2017-53845.9Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more inform