CVE-2015-3449

CWE-2543 documents3 sources
Severity
7.2HIGH
EPSS
0.0%
top 89.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SAP Afaria
Timeline
PublishedJul 16
Latest updateMay 17

Description

The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

▶NVDsap/afaria7.0.6398.0

🔴Vulnerability Details

2
GHSA
GHSA-w97j-f8f4-vm9f: The Windows client in SAP Afaria 7↗2022-05-17
▶
CVEList
CVE-2015-3449: The Windows client in SAP Afaria 7↗2015-07-16
▶
CVE-2015-3449 (HIGH CVSS 7.2) | The Windows client in SAP Afaria 7. | cvebase.io