TI-2015-04250 Aliases CVE-2015-5068 GHSA-h548-2rxv-x7x7

XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers…

LOW 38Published 2015-06-24 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601.

Why it matters now

EPSS 0.02864 86th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:mobile_platform:3.0:::::::*	3.0	Vulnerable	SAP

cpe:2.3:a:sap:mobile_platform:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-5068
2026-10-03 Alias added: GHSA-h548-2rxv-x7x7

References

Advisory 1

http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015

Other 3

TI-2018-01838 Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses… CVSS 3.0HIGH 7.5
TI-2015-07067 The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass… CVSS 2.0HIGH 7.5
TI-2015-05585 XML external entity (XXE) vulnerability in the application import functionality in SAP… CVSS 2.0MEDIUM 6.8
TI-2015-02484 XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to… CVSS 2.0MEDIUM 5.0
TI-2015-02489 XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers… CVSS 2.0MEDIUM 5.0
TI-2015-06423 SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other… CVSS 3.1MEDIUM 5.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences