VulnerabilityModified

CVE-2006-2547

Unspecified vulnerability in the sapdba command in SAP with Informix before 700, and 700 up to patch 100, allows local users to execute arbitrary commands via unknown vectors related to "insecure environment variable" handling.

HIGH 10.0EPSS 3.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 3.37% probability · 88th percentile
CISA KEV: Not listed
Affected: sap/sapdba
Source: cve@mitre.org

References

http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046130.htmlPatch
http://secunia.com/advisories/20180Vendor Advisory
http://securityreason.com/securityalert/941
http://securitytracker.com/id?1016122
http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Local_Privilege_Escalation_in_SAP_sapdba_Command.pdfPatch
http://www.securityfocus.com/archive/1/434534/30/4890/threaded
http://www.securityfocus.com/bid/18028
http://www.vupen.com/english/advisories/2006/1861
https://exchange.xforce.ibmcloud.com/vulnerabilities/26526
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046130.htmlPatch
http://secunia.com/advisories/20180Vendor Advisory
http://securityreason.com/securityalert/941
http://securitytracker.com/id?1016122
http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Local_Privilege_Escalation_in_SAP_sapdba_Command.pdfPatch
http://www.securityfocus.com/archive/1/434534/30/4890/threaded
http://www.securityfocus.com/bid/18028
http://www.vupen.com/english/advisories/2006/1861
https://exchange.xforce.ibmcloud.com/vulnerabilities/26526

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.