CVE-2017-8914

8.3HIGH

Key Information:

Vendor
SAP
Status
Hana Xs
Vendor
CVE Published:
23 May 2017

Summary

sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.

References

http://www.securityfocus.com/bid/96206
vdb-entryx_refsource_BID
https://erpscan.io/advisories/erpscan-17-009-sap-hana-sin...
x_refsource_MISC
https://erpscan.io/press-center/blog/sap-cyber-threat-int...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.