CVE-2015-7727
8.2 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
59.6%
Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the (1) trace configuration page or (2) getSqlTraceConfiguration function, aka SAP Security Note 2153898.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| sap:hana | sap hana | eq | 1.00.73.00.389160 |
References
packetstormsecurity.com/files/133766/SAP-HANA-Trace-Configuration-SQL-Injection.html
packetstormsecurity.com/files/133768/SAP-HANA-getSqlTraceConfiguration-SQL-Injection.html
seclists.org/fulldisclosure/2015/Sep/115
seclists.org/fulldisclosure/2015/Sep/117
www.onapsis.com/research/security-advisories/SAP-HANA-Trace-configuration-SQL-injection
www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition
www.onapsis.com/research/security-advisories/sap-hana-sql-injection-getsqltraceconfiguration-function
Related
8.2 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
59.6%