CVE-2016-4407

EUVD-2016-5407
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
sapsapcryptolib
5.555.38
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2016/Oct/32
http://www.securityfocus.com/bid/93502
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm
http://seclists.org/fulldisclosure/2016/Oct/32
http://www.securityfocus.com/bid/93502
https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm