CVE-2016-9832

CRITIQUE 9.9CVE-2016-9832 · Published 10/12/2016 · updated 17/06/2026

En bref

CVE-2016-9832 est une vulnérabilité CRITIQUE (CVSS 9.9) touchant ace-advanced business application programming (pwc).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.0%, plus élevée que 90.6% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
ace-advanced business application programming pwc	`= 8.10.304`	No fix yet

Description

PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report.

References

packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html · Exploit
seclists.org/fulldisclosure/2016/Dec/33 · Third Party Advisory
securityfocus.com/archive/1/539883/100/0/threaded
securityfocus.com/archive/1/539883/30/0/threaded · Third Party Advisory
securityfocus.com/bid/94733 · Third Party Advisory
esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free