CVE-2002-1578

UNKNOWN

The default installation of SAP R/3, when using Oracle and SQL*net V2 3

Published Mar 16, 2004

Modified 1 years ago

No fix available

Details

The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensitive SAP data by directly connecting to the Oracle database and executing queries against the database, which is not password-protected.

References

WEBhttp://archives.neohapsis.com/archives/bugtraq/2002-04/0387.html WEBhttp://www.securityfocus.com/bid/4613 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/8972 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2002-1578

CVSS Analysis

CVSS v2.0

7.5

Exploitability

Access Vector

NetworkAV:N

Access Complexity

LowAC:L

Authentication

NoneAu:N

Impact

Confidentiality

PartialC:P

Integrity

PartialI:P

Availability

PartialA:P

7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P

Ecosystems

Timeline

PublishedMar 16, 2004

ModifiedAug 8, 2024