PT-2017-3111 · Sap · Sap Point Of Sale

Published 2017-04-03 · Updated 2019-10-03 · CVE-2017-15295

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Point of Sale (POS) Xpress Server (affected versions not specified)

Description The issue is related to the lack of an authentication procedure in the Xpress Server component of the SAP Point of Sale (POS) software. This allows a remote attacker to read, modify, and delete files using port 2200.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2017-02509

CVE-2017-15295

Affected Products

Sap Point Of Sale

References · 8

• https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15295 · Security Note
• https://bdu.fstec.ru/vul/2017-02509 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15295 · Vendor Advisory
• https://erpscan.com/research/hacking-sap-pos · Note
• https://erpscan.io/advisories/erpscan-17-033-sap-pos-missing-authentication-xpressserver · Note
• https://erpscan.com/advisories/erpscan-17-033-sap-pos-missing-authentication-xpressserver · Note
• https://erpscan.io/research/hacking-sap-pos · Note