PT-2015-2428 · Sap · Sap Hana Db

Published 2015-10-15 · Updated 2015-10-16 · CVE-2015-7726

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.091.00.1418659308

Description The issue exists due to insufficient protection of the web page structure in the Development Workbench component of the SAP HANA database management system. This allows a remote attacker to execute arbitrary web or HTML code. The vulnerability can be exploited through a cross-site scripting (XSS) attack in role deletion, where an authenticated user can inject arbitrary web script or HTML via the role name variable.

Recommendations For SAP HANA DB version 1.00.091.00.1418659308, update the system according to the guidance provided in SAP Security Note 2153898 to resolve the issue. As a temporary workaround, consider restricting access to the Development Workbench and limiting the ability to delete roles to minimize the risk of exploitation. Avoid using the role name variable in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11793

CVE-2015-7726

Affected Products

Sap Hana Db

References · 5

• https://bdu.fstec.ru/vul/2015-11793 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7726 · Security Note
• https://onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition · Note
• https://onapsis.com/research/security-advisories/sap-hana-xss-role-deletion-through-web-based-workbench · Note
• http://seclists.org/fulldisclosure/2015/Sep/114 · Note