CVE-2016-4407

Опубликовано: 13 окт. 2016

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.

Ссылки

http://seclists.org/fulldisclosure/2016/Oct/32
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/93502
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm
Permissions Required
http://seclists.org/fulldisclosure/2016/Oct/32
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/93502
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm
Permissions Required

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sap:sapcryptolib:5.555.38:*:*:*:*:*:*:*

EPSS

Процентиль: 37%

0.00158

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-284

Связанные уязвимости

GHSA-vrcm-r83p-fhmh