PT-2017-3111 · Sap · Sap Point Of Sale

Publicado 2017-04-03 · Atualizado 2019-10-03 · CVE-2017-15295

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Point of Sale (POS) Xpress Server (affected versions not specified)

Description The issue is related to the lack of an authentication procedure in the Xpress Server component of the SAP Point of Sale (POS) software. This allows a remote attacker to read, modify, and delete files using port 2200.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

BDU:2017-02509

CVE-2017-15295

Produtos afetados

Sap Point Of Sale

Referências · 8

• https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017 · Aviso do Fabricante
• https://erpscan.com/research/hacking-sap-pos · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15295 · Nota de Segurança
• https://erpscan.io/advisories/erpscan-17-033-sap-pos-missing-authentication-xpressserver · Nota
• https://erpscan.com/advisories/erpscan-17-033-sap-pos-missing-authentication-xpressserver · Nota
• https://bdu.fstec.ru/vul/2017-02509 · Nota de Segurança
• https://erpscan.io/research/hacking-sap-pos · Nota
• https://osv.dev/vulnerability/CVE-2017-15295 · Aviso do Fabricante