A vulnerability classified as critical has been found in SAP Console 7.30. This affects an unknown function. The manipulation with an unknown input leads to a credentials management vulnerability. CWE is classifying the issue as CWE-255. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

SAP Console (aka SAPConsole) 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461.

The weakness was disclosed 10/11/2016 by Nahuel D. Sánchez with Onapsis as 2121461 as confirmed mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The public release has been coordinated in cooperation with SAP. This vulnerability is uniquely identified as CVE-2016-3946 since 04/01/2016. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 341 days. During that time the estimated underground price was around $5k-$25k.

Applying the patch 2121461 is able to eliminate this problem. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Productinfo

Vendor

• SAP

Name

• Console

Version

• 7.30

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion