VulnerabilityModified
CVE-2015-5067
The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
HIGH 7.5EPSS 2.63%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.63% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- sap/netweaver
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/133515/SAP-NetWeaver-AS-FKCDBFTRACE-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/133516/SAP-NetWeaver-AS-LSCT1I13-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
- http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015Vendor Advisory
- http://www.securityfocus.com/bid/75165Third Party Advisory, VDB Entry
- https://erpscan.io/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials/
- https://erpscan.io/advisories/erpscan-15-016-sap-netweaver-hardcoded-credentials/
- http://packetstormsecurity.com/files/133515/SAP-NetWeaver-AS-FKCDBFTRACE-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/133516/SAP-NetWeaver-AS-LSCT1I13-ABAP-Hardcoded-Credentials.htmlThird Party Advisory, VDB Entry
- http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015Vendor Advisory
- http://www.securityfocus.com/bid/75165Third Party Advisory, VDB Entry
- https://erpscan.io/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials/
- https://erpscan.io/advisories/erpscan-15-016-sap-netweaver-hardcoded-credentials/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.