SAP Identity Management vulnerabilities

4 CVEs affecting SAP Identity Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-6258, published 2020-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2416, published 2018-05-09. Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days. SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.
CVE-2018-2417, published 2018-05-09. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted.
CVE-2019-0301, published 2019-05-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted…
CVE-2020-6258, published 2020-05-12. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to…