Vulnerability in SAP Netweaver
CVE-2016-4551
The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.014 (71.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 71.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- SAP Netweaver — versions 2004s
- SAP Aba — versions 7.00
- SAP Basis — versions 7.00
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2016/Oct/3 (mailing-list, Mailing List, Third Party Advisory)
- www.onapsis.com/research/security-advisories/sap-security-audit-log-invalid-add… (Permissions Required, Third Party Advisory)
- www.securityfocus.com/bid/93288 (vdb-entry)
Frequently asked questions
- What is CVE-2016-4551?
- CVE-2016-4551 is a high-severity vulnerability in SAP Netweaver, classified under Improper Access Control. CVSS score: 7.5/10. Published 2016-10-05.
- How severe is CVE-2016-4551?
- High severity. CVSS v3 base score is 7.5 out of 10.