7.5high
CVE-2002-1578
The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sens…
Published 22 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.7%
percentile 86%
Public exploits
0
none known
Summary
The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensitive SAP data by directly connecting to the Oracle database and executing queries against the database, which is not password-protected.
Exploit prediction (EPSS)
2.66% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/8972 · vdb-entry, x_refsource_XF, x_transferred
- archives.neohapsis.com /archives/bugtraq/2002-04/0387.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/4613 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2002-1578
- NVD: CVE-2002-1578
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.