Unscored severity · published Nov 24, 2015
CVE-2015-8329
SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt…
–
CVSS
1%
EPSS
No
On KEV
Description
SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Manufacturing Integration And Intelligence · Sap
12.2; 14.0; 15.0 · source: NVD
Affected product
MI
Manufacturing Integration And Intelligence
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8329
Third Party Advisory
http://packetstormsecurity.com/files/135761/SAP-MII-12.2-14.0-15.0-Cryptography-Issues.html
seclists.org
http://seclists.org/fulldisclosure/2016/Feb/68
erpscan.io
https://erpscan.io/advisories/erpscan-15-031-using-base64-and-des-in-sap-mii/
More from Manufacturing Integration And Intelligence
8.8
CVE-2021-21480
SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment)
8.8
CVE-2019-0267
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens