title: Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
description: Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.
problem types: CWE-640: Weak Password Recovery Mechanism
affected:
{
defaultStatus: unaffected
product: SAP NetWeaver AS Java User Management Engine
vendor: SAP_SE
versions:
status: affected, version: SERVERCORE 7.50
status: affected, version: J2EE-APPS 7.50
status: affected, version: UMEADMIN 7.50
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL