Vulnerability-Lookup

CNVD-2015-03580

Vulnerability from cnvd - Published: 2015-06-04

Title

SAP Afaria信息泄露漏洞

Description

SAP Afaria是德国思爱普（SAP）公司的一套移动设备管理解决方案。该方案支持对移动设备、应用及数据生命周期进行有效管理，并确保其在传输和存储过程中的安全性。 SAP Afaria存在安全漏洞。由于程序未能限制使用服务功能。远程攻击者可利用该漏洞获取敏感信息和权限。

Severity

高

Patch Name

SAP Afaria信息泄露漏洞的补丁

Patch Description

SAP Afaria是德国思爱普（SAP）公司的一套移动设备管理解决方案。该方案支持对移动设备、应用及数据生命周期进行有效管理，并确保其在传输和存储过程中的安全性。 SAP Afaria存在安全漏洞。由于程序未能限制使用服务功能。远程攻击者可利用该漏洞获取敏感信息和权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://service.sap.com/sap/support/notes/2155690

Reference

http://seclists.org/fulldisclosure/2015/May/96

Impacted products

Name
SAP Afaria

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-4161"
    }
  },
  "description": "SAP Afaria\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u79fb\u52a8\u8bbe\u5907\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u5bf9\u79fb\u52a8\u8bbe\u5907\u3001\u5e94\u7528\u53ca\u6570\u636e\u751f\u547d\u5468\u671f\u8fdb\u884c\u6709\u6548\u7ba1\u7406\uff0c\u5e76\u786e\u4fdd\u5176\u5728\u4f20\u8f93\u548c\u5b58\u50a8\u8fc7\u7a0b\u4e2d\u7684\u5b89\u5168\u6027\u3002\r\n\r\nSAP Afaria\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9650\u5236\u4f7f\u7528\u670d\u52a1\u529f\u80fd\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u548c\u6743\u9650\u3002",
  "discovererName": "SAP",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://service.sap.com/sap/support/notes/2155690",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-03580",
  "openTime": "2015-06-04",
  "patchDescription": "SAP Afaria\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u79fb\u52a8\u8bbe\u5907\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u5bf9\u79fb\u52a8\u8bbe\u5907\u3001\u5e94\u7528\u53ca\u6570\u636e\u751f\u547d\u5468\u671f\u8fdb\u884c\u6709\u6548\u7ba1\u7406\uff0c\u5e76\u786e\u4fdd\u5176\u5728\u4f20\u8f93\u548c\u5b58\u50a8\u8fc7\u7a0b\u4e2d\u7684\u5b89\u5168\u6027\u3002 \r\n\r\nSAP Afaria\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9650\u5236\u4f7f\u7528\u670d\u52a1\u529f\u80fd\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u548c\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Afaria\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "SAP Afaria"
  },
  "referenceLink": "http://seclists.org/fulldisclosure/2015/May/96",
  "serverity": "\u9ad8",
  "submitTime": "2015-06-03",
  "title": "SAP Afaria\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2015-4161 (GCVE-0-2015-4161)

Vulnerability from cvelistv5 – Published: 2015-06-02 14:00 – Updated: 2024-08-06 06:04

Summary

SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.securityfocus.com/bid/74800	vdb-entryx_refsource_BID
	http://seclists.org/fulldisclosure/2015/May/96	mailing-listx_refsource_FULLDISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T06:04:02.917Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "74800",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74800"
          },
          {
            "name": "20150522 SAP Security Notes May 2015",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/96"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-29T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "74800",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74800"
        },
        {
          "name": "20150522 SAP Security Notes May 2015",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/96"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-4161",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "74800",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74800"
            },
            {
              "name": "20150522 SAP Security Notes May 2015",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/96"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-4161",
    "datePublished": "2015-06-02T14:00:00",
    "dateReserved": "2015-06-02T00:00:00",
    "dateUpdated": "2024-08-06T06:04:02.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-03580

CVE-2015-4161 (GCVE-0-2015-4161)

Tags

Sightings

Nomenclature