CVE-2015-5067

The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.

• CWE-255

• http://packetstormsecurity.com/files/133515/SAP-NetWeaver-AS-FKCDBFTRACE-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/133516/SAP-NetWeaver-AS-LSCT1I13-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
• http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015Vendor Advisory
• http://www.securityfocus.com/bid/75165Third Party Advisory, VDB Entry
• https://erpscan.io/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials/
• https://erpscan.io/advisories/erpscan-15-016-sap-netweaver-hardcoded-credentials/
• http://packetstormsecurity.com/files/133515/SAP-NetWeaver-AS-FKCDBFTRACE-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/133516/SAP-NetWeaver-AS-LSCT1I13-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
• http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015Vendor Advisory
• http://www.securityfocus.com/bid/75165Third Party Advisory, VDB Entry
• https://erpscan.io/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials/
• https://erpscan.io/advisories/erpscan-15-016-sap-netweaver-hardcoded-credentials/

Published

Jun 24, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5061Cross-site scripting (XSS) vulnerability in Zoho ManageEngin…
• CVE-2015-5062Open redirect vulnerability in SilverStripe CMS & Framework …
• CVE-2015-5063Multiple cross-site scripting (XSS) vulnerabilities in Silve…
• CVE-2015-5064Multiple cross-site scripting (XSS) vulnerabilities in MySql…
• CVE-2015-5065Absolute path traversal vulnerability in proxy.php in the go…
• CVE-2015-5066Multiple cross-site scripting (XSS) vulnerabilities in the M…
• CVE-2015-5068XML external entity (XXE) vulnerability in SAP Mobile Platfo…
• CVE-2015-5069The (1) filesystem::get_wml_location function in filesystem.…
• CVE-2015-5070The (1) filesystem::get_wml_location function in filesystem.…
• CVE-2015-5071AR System Mid Tier in the AR System Mid Tier component befor…6.5
• CVE-2015-5072The BIRT Engine servlet in the AR System Mid Tier component …6.5
• CVE-2015-5073Heap-based buffer overflow in the find_fixedlength function …