CVE-2014-0984: sap router

Vulnerability summary

CVE-2014-0984 is a medium (CVSS 4.3) vulnerability in sap router. EPSS estimates a 2.70% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-04-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.