Lucene search

[email protected]CVE-2001-0366

HistoryMar 09, 2002 - 5:00 a.m.

CVE-2001-0366

2002-03-0905:00:00

[email protected]

web.nvd.nist.gov

sap r/3 web app

user access

root access

environmental variable

cve-2001-0366

path manipulation

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

saposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable to find and execute the expand program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse expand program.

Affected configurations

NVD

Node

sapsap_r_3_web_application_server_demoRange≤1.5

sapsaposcolMatch1.0linux

sapsaposcolMatch1.1linux

sapsaposcolMatch1.2linux

sapsaposcolMatch1.3linux

CPENameOperatorVersion
sap:sap_r_3_web_application_server_demosap sap r 3 web application server demole1.5
sap:saposcolsap saposcoleq1.0
sap:saposcolsap saposcoleq1.1
sap:saposcolsap saposcoleq1.2
sap:saposcolsap saposcoleq1.3

CPE	Name	Operator	Version
sap:sap_r_3_web_application_server_demo	sap sap r 3 web application server demo	le	1.5
sap:saposcol	sap saposcol	eq	1.0
sap:saposcol	sap saposcol	eq	1.1
sap:saposcol	sap saposcol	eq	1.2
sap:saposcol	sap saposcol	eq	1.3

References

ftp://ftp.sap.com/pub/linuxlab/saptools/README.saposcol

www.securityfocus.com/archive/1/180498

www.securityfocus.com/bid/2662

exchange.xforce.ibmcloud.com/vulnerabilities/6487

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2001-0366

cvelist1 nvd1