Lucene search
HistoryJul 16, 2015 - 2:59 p.m.
CVE-2015-3449
cve-2015-3449
sap afaria
windows client
weak permissions
local privilege escalation
nvd
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
6.6 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.
Affected configurations
Node
sapafariaMatch7.0.6398.0
| CPE | Name | Operator | Version |
|---|---|---|---|
| sap:afaria | sap afaria | eq | 7.0.6398.0 |
Related
prion
prion
Code injection
2015-07-16 14:59:00
cvelist
cvelist
CVE-2015-3449
2015-07-16 14:00:00
nvd
nvd
CVE-2015-3449
2015-07-16 14:59:02
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
6.6 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
Related for CVE-2015-3449