CVE-2015-2817
SAP Management Console Information Disclosure
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
La consola de gestión de SAP en SAP NetWeaver 7.40 permite a atacantes remotos obtener información sensible a través de los parámetros ReadProfile, también conocido como la nota de seguridad de SAP 2091768.
The management console of SAP NW version 7.4 suffers from an information disclosure vulnerability. It is possible to get some information from the web interface of CCMS without authentication. An attacker can use the information for subsequent attacks which will lead to illegal access to business-critical information.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2015-04-01 CVE Reserved
- 2015-04-01 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
http://packetstormsecurity.com/files/132359/SAP-Management-Console-Information-Disclosure.html | X_refsource_misc |
|
http://seclists.org/fulldisclosure/2015/Jun/65 | Mailing List |
|
http://www.securityfocus.com/archive/1/535829/100/800/threaded | Mailing List | |
http://www.securityfocus.com/bid/73705 | Vdb Entry | |
https://erpscan.io/advisories/erpscan-15-007-sap-management-console-readprofile-parameters-information-disclosure | X_refsource_misc |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|