CVE-2015-2816: sap afaria Improper Access Control

EPSS trend

Probability

2.56%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

0.00 pp

From 2.56% on 21-09-2026

21-09-202621-10-2026

EPSS score

2.56%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

5 links

www.securityfocus.com/archive/1/535830/100/800/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/73708VDB EntryX Refsource BID
packetstormsecurity.com/files/132363/SAP-Afaria-7-Missing-Authorization-Check.htmlX Refsource MISC
seclists.org/fulldisclosure/2015/Jun/67Mailing ListX Refsource FULLDISC
erpscan.io/advisories/erpscan-15-009-sap-afaria-7-xclistener-missing-authorization-check/X Refsource MISC

Related vulnerabilities

CVE-2015-2820sapafaria3.58%11y ago01-04-2015 14:00Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.CVE-2015-4161sapafaria1.41%11y ago02-06-2015 14:00SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.CVE-2015-4092sapafaria3.13%11y ago26-05-2015 14:00Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.CVE-2015-6663sapafaria1.27%11y ago24-08-2015 14:00Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.CVE-2015-8753sapafaria2.11%10y ago08-01-2016 19:00SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP Security Note 2134905.CVE-2015-3449sapafaria0.53%11y ago16-07-2015 14:00The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.

All vulnerabilities inafaria

CVE-2015-2816: sap afaria Improper Access Control

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References