CVE-2016-4407

The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
VendorProductVersion
sapsapcryptolib
5.555.38
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2016/Oct/32
http://www.securityfocus.com/bid/93502
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm
http://seclists.org/fulldisclosure/2016/Oct/32
http://www.securityfocus.com/bid/93502
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm