CVE-2008-4387

Published: Nov 10, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary code via unknown vectors involving instantiation by Internet Explorer.

Affected (2)

Products: Sap: Sapgui · Simba Technologies: Mdrmsap Activex Control

Sap

1 product

Sapgui

Simba Technologies

1 product

Mdrmsap Activex Control

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sap Sapgui	All versions
Simba Technologies Mdrmsap Activex Control	All versions

Running on/with	Platform Versions
Microsoft Internet Explorer	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (10)

http://osvdb.org/49721

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/277313

Source: cret@cert.org

US Government Resource

http://www.securityfocus.com/bid/32186

Source: cret@cert.org

http://www.vupen.com/english/advisories/2008/3106

Source: cret@cert.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/46440

Source: cret@cert.org

http://osvdb.org/49721