Sign-up

ID

VAR-201703-1156


CVE

CVE-2017-6950


TITLE

SAP GUI In Vulnerabilities that circumvent security policy restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2017-002686

DESCRIPTION

SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions and execute arbitrary code via a crafted ABAP code, aka SAP Security Note 2407616. SAP GUI is prone to a remote code-execution vulnerability. An attacker may exploit this issue to execute arbitrary code within the context of the affected application. The title and technical details have been changed to better reflect the vulnerability impact

Trust: 1.89

sources: NVD: CVE-2017-6950 // JVNDB: JVNDB-2017-002686 // BID: 96872

AFFECTED PRODUCTS

vendor:sapmodel:gui for windowsscope:eqversion:7.50_core_sp000

Trust: 1.6

vendor:sapmodel:gui for windowsscope:eqversion:7.30

Trust: 1.6

vendor:sapmodel:gui for windowsscope:eqversion:7.20

Trust: 1.6

vendor:sapmodel:gui for windowsscope:eqversion:7.40_core_sp00-sp011

Trust: 1.6

vendor:sapmodel:guiscope:eqversion:for windows 7.2 to 7.5

Trust: 0.8

vendor:sapmodel:gui core sp000scope:eqversion:7.50

Trust: 0.3

vendor:sapmodel:guiscope:eqversion:7.30

Trust: 0.3

vendor:sapmodel:guiscope:eqversion:7.20

Trust: 0.3

vendor:sapmodel:guiscope:eqversion:10.0.1

Trust: 0.3

sources: BID: 96872 // JVNDB: JVNDB-2017-002686 // CNNVD: CNNVD-201703-691 // NVD: CVE-2017-6950

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6950
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-6950
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201703-691
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2017-6950
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2017-6950
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: JVNDB: JVNDB-2017-002686 // CNNVD: CNNVD-201703-691 // NVD: CVE-2017-6950

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.0

problemtype:CWE-284

Trust: 0.8

sources: JVNDB: JVNDB-2017-002686 // NVD: CVE-2017-6950

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-691

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201703-691

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002686

PATCH
title:Top Pageurl:https://www.sap.com/index.html
Trust: 0.8
title:SAP GUI Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68525
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-002686 // 
            
            
            
            CNNVD: CNNVD-201703-691

EXTERNAL IDS
db:NVDid:CVE-2017-6950
Trust: 2.7
db:BIDid:96872
Trust: 2.7
db:SECTRACKid:1038122
Trust: 1.6
db:JVNDBid:JVNDB-2017-002686
Trust: 0.8
db:CNNVDid:CNNVD-201703-691
Trust: 0.6
sources:
            
            
            BID: 96872 // 
            
            
            
            JVNDB: JVNDB-2017-002686 // 
            
            
            
            CNNVD: CNNVD-201703-691 // 
            
            
            
            NVD: CVE-2017-6950

REFERENCES
url:http://www.securityfocus.com/bid/96872
Trust: 2.4
url:http://www.securitytracker.com/id/1038122
Trust: 1.6
url:https://erpscan.io/advisories/erpscan-17-011-sap-gui-versions-remote-code-execution-bypass-security-policy/
Trust: 1.6
url:https://erpscan.com/advisories/erpscan-17-011-sap-gui-versions-remote-code-execution-bypass-security-policy/
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6950
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-6950
Trust: 0.8
url:http://www.sap.com/
Trust: 0.3
url:https://threatpost.com/sap-vulnerability-puts-business-data-at-risk-for-thousands-of-companies/124473/
Trust: 0.3
url:https://service.sap.com/sap/support/notes/2407616
Trust: 0.3
url:https://blogs.sap.com/2017/04/11/sap-security-patch-day-april-2017/
Trust: 0.3
url:https://blogs.sap.com/2017/03/14/sap-security-patch-day-march-2017/ 
Trust: 0.3
sources:
            
            
            BID: 96872 // 
            
            
            
            JVNDB: JVNDB-2017-002686 // 
            
            
            
            CNNVD: CNNVD-201703-691 // 
            
            
            
            NVD: CVE-2017-6950

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 96872

SOURCES
db:BIDid:96872
db:JVNDBid:JVNDB-2017-002686
db:CNNVDid:CNNVD-201703-691
db:NVDid:CVE-2017-6950

LAST UPDATE DATE
2024-11-23T22:45:45.643000+00:00

SOURCES UPDATE DATE
db:BIDid:96872date:2017-04-18T02:04:00
db:JVNDBid:JVNDB-2017-002686date:2017-04-25T00:00:00
db:CNNVDid:CNNVD-201703-691date:2019-10-23T00:00:00
db:NVDid:CVE-2017-6950date:2024-11-21T03:30:50.517

SOURCES RELEASE DATE
db:BIDid:96872date:2017-03-14T00:00:00
db:JVNDBid:JVNDB-2017-002686date:2017-04-25T00:00:00
db:CNNVDid:CNNVD-201703-691date:2017-03-17T00:00:00
db:NVDid:CVE-2017-6950date:2017-03-23T20:59:00.877