CVE-2014-5176 : SAP FI Manager Self-Service has a hard-coded user name, which makes it easier fo

SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.

Published 2014-07-31 14:55:04

Updated 2018-10-09 19:50:02

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2014-5176

SAP » Fi Manager Self-service » Version: N/A
cpe:2.3:a:sap:fi_manager_self-service:-:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.65%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P	6.8	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-024

Page Not Found | Onapsis
https://service.sap.com/sap/support/notes/1929473
http://www.securityfocus.com/bid/68951

SAP FI Manager Self-Service Hardcoded Credentials Security Bypass Vulnerability
http://packetstormsecurity.com/files/127669/SAP-FI-Manager-Self-Service-Hardcoded-Username.html

SAP FI Manager Self-Service Hardcoded Username ≈ Packet Storm
http://scn.sap.com/docs/DOC-8218

Acknowledgments to Security Researchers - Security and Identity Management - SCN Wiki

CVEs referencing this url
http://seclists.org/fulldisclosure/2014/Jul/152

Full Disclosure: [Onapsis Security Advisory 2014-024] Hard-coded Username in SAP FI Manager Self-Service
https://exchange.xforce.ibmcloud.com/vulnerabilities/94923

SAP FI Manager Self-Service default account CVE-2014-5176 Vulnerability Report
http://www.securityfocus.com/archive/1/532945/100/0/threaded

SecurityFocus

Jump to