Unscored severity · published Apr 30, 2014
CVE-2014-3130
The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to…
–
CVSS
0.3%
EPSS
No
On KEV
Description
The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netweaver Abap Application Server · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3130
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3130
scn.sap.com
http://scn.sap.com/docs/DOC-8218
seclists.org
http://seclists.org/fulldisclosure/2014/Apr/302
www.onapsis.com
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009
www.securityfocus.com
http://www.securityfocus.com/bid/67108
service.sap.com
https://service.sap.com/sap/support/notes/1910914
More from Netweaver Abap Application Server
–
CVE-2015-4158
SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661
–
CVE-2015-2282
Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server…
–
CVE-2015-2278
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application…