CVE-2007-3614: sap sap_db

EPSS trend

Probability

70.00%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 70.00% on 21-09-2026

21-09-202621-10-2026

EPSS score

70.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
MetasploitremoteVerified
SAP DB 7.4 WebTools Buffer Overflow
exploit/windows/http/sapdb_webtools
Maturity: weaponized
exploit-databaseremotewindowsVerified
SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)
Maturity: weaponized

Show all 5 exploits

exploit-databaseremotewindowsVerified
SAP DB 7.4 - WebTools Remote Overwrite (SEH)
Maturity: weaponized
exploit-databaseremotewindowsVerified
SAP DB 7.x Web Server - 'WAHTTP.exe' Multiple Buffer Overflow Vulnerabilities
Maturity: weaponized

References

10 links

www.ngssoftware.com/advisories/critical-risk-vulnerability-in-sap-db-web-server-stack-overflow/X Refsource MISC
www.securitytracker.com/id?1018341VDB EntryX Refsource SECTRACK
exchange.xforce.ibmcloud.com/vulnerabilities/35277VDB EntryX Refsource XF
www.securityfocus.com/bid/24773VDB EntryX Refsource BIDExploitPatch
osvdb.org/37838VDB EntryX Refsource OSVDB
www.securityfocus.com/archive/1/472891/100/0/threadedMailing ListX Refsource BUGTRAQ
securityreason.com/securityalert/2867Third Party AdvisoryX Refsource SREASON
www.kb.cert.org/vuls/id/679041Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.vupen.com/english/advisories/2007/2453VDB EntryX Refsource VUPEN
secunia.com/advisories/25954Third Party AdvisoryX Refsource SECUNIA

Related vulnerabilities

CVE-2003-1033sapsap_db0.35%22y ago16-03-2004 05:00The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.CVE-2003-0941sapsap_db1.50%22y ago21-11-2003 05:00web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa.CVE-2003-0944sapsap_db2.73%22y ago21-11-2003 05:00Buffer overflow in the WAECHO default service in web-tools in SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a URL with a long requestURI.CVE-2003-0942sapsap_db2.73%22y ago21-11-2003 05:00Buffer overflow in Web Agent Administration service in web-tools for SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a long Name parameter to waadmin.wa.CVE-2003-0943sapsap_db1.50%22y ago21-11-2003 05:00web-tools in SAP DB before 7.4.03.30 installs several services that are enabled by default, which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases via (1) waecho, (2) Web SQL Interface (websql), or (3) Web Database Manager (webdbm).CVE-2003-0945sapsap_db1.49%22y ago21-11-2003 05:00The Web Database Manager in web-tools for SAP DB before 7.4.03.30 generates predictable session IDs, which allows remote attackers to conduct unauthorized activities.

All vulnerabilities insap_db

CVE-2007-3614: sap sap_db

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References