CVEvulnerability
CVE-2017-8914
8.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-05-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.3 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.
Affected configurations
• sap hana xs 1.00
• sap hana xs 2.00
References
- http://www.securityfocus.com/bid/96206 Third Party Advisory, VDB Entry
- https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/ erpscan.io
- https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/ erpscan.io
- http://www.securityfocus.com/bid/96206 Third Party Advisory, VDB Entry
- https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/ erpscan.io
- https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/ erpscan.io