Lucene search
HistoryApr 15, 2004 - 4:00 a.m.
CVE-2003-1035
sap r/3
installation
remote attackers
account locking
brute force
sapgui
rfc api
password guessing
nvd
7.7 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
84.2%
The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.
| CPE | Name | Operator | Version |
|---|---|---|---|
| sap:sapgui | sap sapgui | eq | 4.6c |
| sap:sap_r_3 | sap sap r 3 | eq | * |
| sap:sapgui | sap sapgui | eq | 4.6d |
7.7 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
84.2%