Lucene search

[email protected]CVE-2017-15293

HistoryOct 16, 2017 - 4:29 p.m.

CVE-2017-15293

2017-10-1616:29:00

CWE-287

[email protected]

web.nvd.nist.gov

sap

pos

xpress server

security

authentication

file operations

nvd

cve-2017-15293

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.1%

JSON

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064.

Affected configurations

NVD

Node

sappoint_of_sale_xpress_serverMatch1020

sappoint_of_sale_xpress_serverMatch1030

CPENameOperatorVersion
sap:point_of_sale_xpress_serversap point of sale xpress servereq1020
sap:point_of_sale_xpress_serversap point of sale xpress servereq1030

CPE	Name	Operator	Version
sap:point_of_sale_xpress_server	sap point of sale xpress server	eq	1020
sap:point_of_sale_xpress_server	sap point of sale xpress server	eq	1030

References

www.securityfocus.com/bid/100713

blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/

erpscan.io/advisories/erpscan-17-032-sap-pos-missing-authentication-xpressserver/

erpscan.io/research/hacking-sap-pos/

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.1%

JSON

Related for CVE-2017-15293

nvd1 cvelist1 prion1