Unscored severity · published Nov 4, 2014
CVE-2014-8587
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature…
–
CVSS
1.3%
EPSS
No
On KEV
Description
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Commoncryptolib · Sap
through 8.4.29 · source: NVD
HA
Hana · Sap
All versions, or not specified · source: NVD
NE
Netweaver · Sap
All versions, or not specified · source: NVD
SA
Sapcryptolib · Sap
through 5.555.37 · source: NVD
SA
Sapseculib · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8587
Broken Link
http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/
Not Applicable
http://secunia.com/advisories/57606
Permissions Required
http://service.sap.com/sap/support/notes/2067859
Broken Link
https://twitter.com/SAP_Gsupport/status/522401681997570048
More from Commoncryptolib
9.8
CVE-2023-40309
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation…
7.5
CVE-2023-40308
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes…
7.5
CVE-2021-38177
SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP…