PT-2015-2428 · Sap · Sap Hana Db

Publicado 2015-10-15 · Atualizado 2015-10-16 · CVE-2015-7726

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.091.00.1418659308

Description The issue exists due to insufficient protection of the web page structure in the Development Workbench component of the SAP HANA database management system. This allows a remote attacker to execute arbitrary web or HTML code. The vulnerability can be exploited through a cross-site scripting (XSS) attack in role deletion, where an authenticated user can inject arbitrary web script or HTML via the role name variable.

Recommendations For SAP HANA DB version 1.00.091.00.1418659308, update the system according to the guidance provided in SAP Security Note 2153898 to resolve the issue. As a temporary workaround, consider restricting access to the Development Workbench and limiting the ability to delete roles to minimize the risk of exploitation. Avoid using the role name variable in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-11793

CVE-2015-7726

Produtos afetados

Sap Hana Db

Referências · 5

• https://bdu.fstec.ru/vul/2015-11793 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-7726 · Nota de Segurança
• https://onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition · Nota
• https://onapsis.com/research/security-advisories/sap-hana-xss-role-deletion-through-web-based-workbench · Nota
• http://seclists.org/fulldisclosure/2015/Sep/114 · Nota