Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping (SAP_SE NW AS Java UME User Mapping)
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 4 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Deferred
Description
The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.
Faiblesses (CWE)
- CWE-326 — Force de chiffrement insuffisante
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | LOW 3.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N | sap |
| CVSS 3.1 | LOW 3.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-2379
- GCVE · GCVE-0-2026-0510
Avis du CERT-FR
- CERTFR-2026-AVI-0034 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · NW AS Java UME User Mapping | affected ENGINEAPI 7.50 ; affected SERVERCORE 7.50 ; affected UMEADMIN 7.50 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |