PT-2015-2431 · Sap · Sap Hana Developer Edition

Nahuel D. Sánchez + 1 · Publicado 2015-10-15 · Atualizado 2015-10-16 · CVE-2015-7729

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP HANA Developer Edition DB version 1.00.091.00.1418659308

Description The issue is related to eval injection in the Web-based Development Workbench, allowing remote authenticated users to execute arbitrary XSJS code. This is due to incorrect code generation management in the Development Workbench component of the SAP HANA database management system. Exploitation of this issue can enable a remote attacker to execute arbitrary XSJS code.

Recommendations For SAP HANA Developer Edition DB version 1.00.091.00.1418659308, consider disabling the Development Workbench or restricting access to it until a fix is available. As a temporary workaround, restrict the execution of XSJS code in the Development Workbench to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2015-11796

CVE-2015-7729

Produtos afetados

Sap Hana Developer Edition

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-7729 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11796 · Nota de Segurança
• http://seclists.org/fulldisclosure/2015/Sep/112 · Nota
• https://onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition · Nota
• http://packetstormsecurity.com/files/133763/SAP-HANA-test-net.xsjs-Code-Injection.html · Nota
• https://onapsis.com/research/security-advisories/sap-hana-xsjs-code-injection-test-net · Nota