Vulnerability Report

CVE-2017-8914

Title: Sap Hana Xs

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-8914.

CWE Category NVD-CWE-noinfo

Published Date May 23, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 8.3 CVSS v3.0

Exploit Probability (EPSS)

1.49%

Vulnerability Summary

CVE-2017-8914: sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.

Impacted Vendors

sap 1

Reference Links

http://www.securityfocus.com/bid/96206 https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/ https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/ http://www.securityfocus.com/bid/96206 https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/ https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/

CVSS v3.0

Source Entity [email protected]

Severity HIGH

8.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns