CVE-2016-3640

{"id": "CVE-2016-3640", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2016-08-05T14:59:07.720", "references": [{"url": "http://www.securityfocus.com/bid/92068", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://layersevensecurity.com/wp-content/uploads/2015/10/Layer-Seven-Security_SAP-Security-Notes_August-2015.pdf", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "https://www.onapsis.com/blog/analyzing-sap-security-notes-august-2015-edition", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.onapsis.com/research/security-advisories/sap-hana-password-disclosure", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.091.00.1418659308 allows local users to obtain sensitive password information via vectors related to passwords in Web Dispatcher trace files, aka SAP Security Note 2148905."}, {"lang": "es", "value": "El Extended Application Services (tambi\u00e9n conocido como XS o XS Engine) en SAP HANA DB 1.00.091.00.1418659308 permite a usuarios locales obtener informaci\u00f3n sensible de contrase\u00f1as a trav\u00e9s de vectores relacionados con contrase\u00f1as en archivos de registro de seguimiento Web Dispatcher, tambi\u00e9n conocido como SAP Security Note 2148905."}], "lastModified": "2016-08-11T14:12:13.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:hana_db:1.00.091.00.14186593:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "915F5750-3451-4FC8-8726-5FE3F453BD7C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}