CVE-2003-1033: sap sap_db
Vulnerability summary
CVE-2003-1033 is a high (CVSS 7.2) vulnerability in sap sap_db. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.2% of scored vulnerabilities.
Timeline
- 16-03-2004PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Sap1 product
- sap_db7.3.00 | 7.4
1 vendor · 1 product