SAP Download Manager vulnerabilities

2 CVEs affecting SAP Download Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-3685, published 2016-12-14.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-3684, published 2016-12-14. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging…
• CVE-2016-3685, published 2016-12-14. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attackers to obtain sensitive configuration…