6.5

CVE-2014-6283

Exploit
SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a crafted RPC message to the hacmpmsgxchg function, and possibly other vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.15% 0.627
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://scn.sap.com/docs/DOC-55451
Vendor Advisory
http://blog.spiderlabs.com/2014/09/cve-2014-6283-sap-ase-missing-authorization-checks-and-arbitrary-code-execution.html
Third Party Advisory
Exploit
http://secunia.com/advisories/61238
https://exchange.xforce.ibmcloud.com/vulnerabilities/99935
https://service.sap.com/sap/support/notes/2044220
Vendor Advisory
Permissions Required
https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-013.txt
Third Party Advisory
Exploit