Medium severity · published Oct 13, 2016
CVE-2016-4407
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via…
6.5
CVSS
1%
EPSS
No
On KEV
Description
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sapcryptolib · Sap
5.555.38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4407
Mailing List
http://seclists.org/fulldisclosure/2016/Oct/32
www.securityfocus.com
http://www.securityfocus.com/bid/93502
Permissions Required
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm
More from Sapcryptolib
–
CVE-2014-8587
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature…