Unscored severity · published Jun 2, 2015
CVE-2015-4161
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other…
–
CVSS
1.4%
EPSS
No
On KEV
Description
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Afaria · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4161
Exploit
http://seclists.org/fulldisclosure/2015/May/96
www.securityfocus.com
http://www.securityfocus.com/bid/74800
More from Afaria
9.1
CVE-2015-8753
SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP…
–
CVE-2015-6663
Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted…
–
CVE-2015-3449
The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a…
–
CVE-2015-4092
Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted…
–
CVE-2015-2820
Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note…