CVEvulnerability
CVE-2017-15293
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-10-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-287
Description
Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064.
Affected configurations
• sap point of sale xpress server 1020
• sap point of sale xpress server 1030
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://www.securityfocus.com/bid/100713 Third Party Advisory, VDB Entry
- https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/ Issue Tracking, Vendor Advisory
- https://erpscan.io/advisories/erpscan-17-032-sap-pos-missing-authentication-xpressserver/ erpscan.io
- https://erpscan.io/research/hacking-sap-pos/ erpscan.io
- http://www.securityfocus.com/bid/100713 Third Party Advisory, VDB Entry
- https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/ Issue Tracking, Vendor Advisory
- https://erpscan.io/advisories/erpscan-17-032-sap-pos-missing-authentication-xpressserver/ erpscan.io
- https://erpscan.io/research/hacking-sap-pos/ erpscan.io