PT-2016-7313 · Sap · Sap Ase

Publicado 2016-11-03 · Atualizado 2016-11-28 · CVE-2016-7402

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP ASE versions 16.0 SP02 PL03 and prior

Description The issue allows attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import sproc SQL injection.

Recommendations For SAP ASE versions 16.0 SP02 PL03 and prior, consider restricting access to the dbcc import sproc function until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-7402

Produtos afetados

Sap Ase

Referências · 4

• https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-017/?fid=8409 · Nota
• http://securityfocus.com/bid/92950 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7402 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7402 · Aviso do Fabricante