Vulnerability Name:

CVE-2014-3131 (CCN-92886)

Assigned:2014-04-28
Published:2014-04-28
Updated:2014-05-10
Summary:SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2014-3131

Source: CONFIRM
Type: UNKNOWN
http://scn.sap.com/docs/DOC-8218

Source: CCN
Type: Full Disclosure Mailing List: Mon 28 Apr 2014
[Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance

Source: FULLDISC
Type: UNKNOWN
20140428 [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance

Source: MISC
Type: UNKNOWN
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007

Source: BID
Type: UNKNOWN
67103

Source: CCN
Type: BID-67103
SAP Solution Manager Profile Maintenance Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
solution-manager-profile-sec-bypass(92886)

Source: CCN
Type: SAP Web site
SAP Security Note 1917381

Source: CONFIRM
Type: UNKNOWN
https://service.sap.com/sap/support/notes/1917381

Vulnerable Configuration:Configuration 1:
  • cpe:/a:sap:profile_maintenance:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    sap profile maintenance -