PT-2015-2431 · Sap · Sap Hana Developer Edition

Nahuel D. Sánchez + 1 · Published 2015-10-15 · Updated 2015-10-16 · CVE-2015-7729

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP HANA Developer Edition DB version 1.00.091.00.1418659308

Description The issue is related to eval injection in the Web-based Development Workbench, allowing remote authenticated users to execute arbitrary XSJS code. This is due to incorrect code generation management in the Development Workbench component of the SAP HANA database management system. Exploitation of this issue can enable a remote attacker to execute arbitrary XSJS code.

Recommendations For SAP HANA Developer Edition DB version 1.00.091.00.1418659308, consider disabling the Development Workbench or restricting access to it until a fix is available. As a temporary workaround, restrict the execution of XSJS code in the Development Workbench to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-11796

CVE-2015-7729

Affected Products

Sap Hana Developer Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-7729 · Security Note
• https://bdu.fstec.ru/vul/2015-11796 · Security Note
• http://seclists.org/fulldisclosure/2015/Sep/112 · Note
• https://onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition · Note
• http://packetstormsecurity.com/files/133763/SAP-HANA-test-net.xsjs-Code-Injection.html · Note
• https://onapsis.com/research/security-advisories/sap-hana-xsjs-code-injection-test-net · Note