Download Manager
CVE-2016-3684
MEDIUM
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338.
AnalysisAI
SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging. Rated medium severity (CVSS 4.7). Public exploit code available and no vendor patch available.
Technical ContextAI
SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338. Affected products include: Sap Download Manager.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Download Manager
View allAn issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receivin
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.
Unauth. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low at
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL co
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowin
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PH
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a downlo
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today