{"id": "SECURITYVULNS:VULN:14344", "bulletinFamily": "software", "title": "SAP HANA XSS", "description": "Crossite scripting in Web-based Development Workbench.", "published": "2015-03-21T00:00:00", "modified": "2015-03-21T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14344", "reporter": "BUGTRAQ", "references": ["https://vulners.com/securityvulns/securityvulns:doc:31843"], "cvelist": ["CVE-2015-2072"], "type": "securityvulns", "lastseen": "2018-08-31T11:09:59", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "0f62cf9e0501e0e1bd575f79e1a1fbc8"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "76480016c2c74120c27cb01f1a990c7b"}, {"key": "cvss", "hash": "6e9bdd2021503689a2ad9254c9cdf2b3"}, {"key": "description", "hash": "9d5b1fb7ef2ce87a8ec09393bde92030"}, {"key": "href", "hash": "e005b438c77d1a284d85f260fd6c6d41"}, {"key": "modified", "hash": "a34abbc8939e10fdb2c168fd4e1e23fb"}, {"key": "published", "hash": "a34abbc8939e10fdb2c168fd4e1e23fb"}, {"key": "references", "hash": "a0b58241176a59c6e856b71360e5c825"}, {"key": "reporter", "hash": "2c5cca82a8670da097919f6160833daf"}, {"key": "title", "hash": "6f0932491d18dd1e1dd85ba9081caddf"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "4f80c6129edd0cbfb5eff55d289369530615785d15d500f915fda3543b46f762", "viewCount": 2, "enchantments": {"score": {"value": 4.3, "vector": "NONE", "modified": "2018-08-31T11:09:59"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2015-2072"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:31843"]}], "modified": "2018-08-31T11:09:59"}, "vulnersScore": 4.3}, "objectVersion": "1.3", "affectedSoftware": [{"name": "HANA", "operator": "eq", "version": "73"}]}

{"cve": [{"lastseen": "2018-10-10T11:05:49", "bulletinFamily": "NVD", "description": "Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or (2) xs/ide/editor/templates/trace/hanaTraceDetailService.xsjs, aka SAP Note 2069676.", "modified": "2018-10-09T15:56:01", "published": "2015-02-27T10:59:01", "id": "CVE-2015-2072", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2072", "title": "CVE-2015-2072", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:58", "bulletinFamily": "software", "description": "\r\n\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\nOnapsis Security AdvisoryONAPSIS-2015-001: Multiple Reflected Cross Site\r\nScripting Vulnerabilities in SAP HANA Web-based Development Workbench\r\n\r\n\r\n1. Impact on Business\r\n=====================\r\n\r\nBy exploiting this vulnerability a remote unauthenticated attacker would be\r\nable to attack other users of the system.\r\n\r\nRisk Level: Medium\r\n\r\n\r\n2. Advisory Information\r\n=========================\r\n- - Public Release Date: 2015-02-25\r\n\r\n- - Subscriber Notification Date: 2015-02-25\r\n\r\n- - Last Revised: 2015-02-25\r\n\r\n- - Security Advisory ID: ONAPSIS-2015-001\r\n\r\n- - Onapsis SVS ID: ONAPSIS-00137 and ONAPSIS-00138\r\n\r\n- - CVE: CVE-2015-2072\r\n\r\n- - Researcher: Will Vandevanter\r\n\r\n- - Initial Base CVSS v2: 4.3 (AV:N/AC:M/AU:N/C:N/I:P/A:N)\r\n\r\n\r\n3. Vulnerability Information\r\n============================\r\n\r\n- - Vendor: SAP\r\n\r\n- - Affected Components:\r\n -HANA - Release 73 (1.00.73.00.389160)\r\n - HANA Developer Edition - Release 80 (1.00.80.00.391861)\r\n (Check SAP Note 2069676 for detailed information on affected releases)\r\n\r\n- - Vulnerability Class: CWE-79: Improper Neutralization of Input During\r\nWeb Page Generation (Reflected Cross-Site Scripting)\r\n\r\n- - Remotely Exploitable: Yes\r\n\r\n- - Locally Exploitable: No\r\n\r\n- - Authentication Required: No\r\n\r\n- - Original Advisory:\r\nhttp://www.onapsis.com/research/security-advisories/multiple-reflected-cross-site-scripting-vulnerabilities-in-sap-hana-webbased-development-workbench\r\n\r\n\r\n4. Affected Components Description\r\n==================================\r\n\r\nSAP HANA is a platform for real-time business. It combines database,\r\ndata processing, and application platform capabilities in-memory. The\r\nplatform provides libraries for predictive, planning, text processing,\r\nspatial, and business analytics.\r\n\r\n\r\n5. Vulnerability Details\r\n========================\r\n\r\nThe SAP HANA contains a reflected Cross Site Scripting Vulnerability\r\n(XSS) on the page\r\n/sap/hana/ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs\r\nand /sap/hana/xs/ide/editor/templates/trace/hanaTraceDetailService.xsjs.\r\n\r\nA reflected cross-site scripting attack can be used to non-permanently\r\ndeface or modify displayed content from a Web site. Reflected cross-site\r\nscripting can be used to steal another user's authentication\r\ninformation, such as data relating to their current session. An attacker\r\nwho gains access to this data may use it to impersonate the user and\r\naccess all information with the same rights as the target user. If an\r\nadministrator is impersonated, the security of he application may be\r\nfully compromised.\r\n\r\n\r\n6. Solution\r\n===========\r\n\r\nSAP has released SAP Note 2069676 which provide patched versions of the\r\naffected components.\r\n\r\nThe patches can be downloaded from\r\nhttps://service.sap.com/sap/support/notes/2069676\r\n\r\nOnapsis strongly recommends SAP customers to download the related\r\nsecurity fixes and apply them to the affected components in order to\r\nreduce business risks.\r\n\r\n\r\n7. Report Timeline\r\n==================\r\n\r\n2014-02-25: Onapsis provides vulnerability information to SAP AG.\r\n2014-02-26: SAP confirms having the information of vulnerability.\r\n2014-10-14: SAP releases security patches.\r\n2015-02-25: Onapsis releases security advisory.\r\n\r\n\r\nAbout Onapsis Research Labs\r\n===========================\r\n\r\nOnapsis Research Labs provides the industry analysis of key security\r\nissues that impact business-critical systems and applications.\r\nDelivering frequent and timely security and compliance advisories with\r\nassociated risk levels, Onapsis Research Labs combine in-depth knowledge\r\nand experience to deliver technical and business-context with sound\r\nsecurity judgment to the broader information security community.\r\n\r\n\r\nAbout Onapsis, Inc.\r\n===================\r\n\r\nOnapsis gives organizations the adaptive advantage to succeed in\r\nsecuring business-critical applications by combining technology,\r\nresearch and analytics. Onapsis enables every security and compliance\r\nteam an adaptive approach to focus on the factors that matter most to\r\ntheir business-critical applications that house vital data and run\r\nbusiness processes including SAP Business Suite, SAP HANA and SAP Mobile\r\ndeployments.\r\n\r\nOnapsis provides technology solutions including Onapsis X1, the de-facto\r\nSAP security auditing tool, and Onapsis Security Platform which delivers\r\nenterprise vulnerability, compliance, detection and response\r\ncapabilities with analytics.\r\n\r\nThe Onapsis Research Labs provide subject matter expertise that combines\r\nin-depth knowledge and experience to deliver technical and\r\nbusiness-context with sound security judgment. This enables\r\norganizations to efficiently uncover security and compliance gaps and\r\nprioritize the resolution within applications running on SAP platforms.\r\n\r\nOnapsis delivers tangible business results including decreased business\r\nrisk, highlighted compliance gaps, lower operational security costs and\r\ndemonstrable value on investment.\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\nComment: Onapsis Research Team\r\n\r\niEYEARECAAYFAlTt3s8ACgkQz3i6WNVBcDXcCACcDjpFk1cO1kqYD1v6LK4vNZYZ\r\nGasAn1W0u+Txsq6ijkbG8nfU8H+82h8q\r\n=0Xwr\r\n-----END PGP SIGNATURE-----\r\n\r\n", "modified": "2015-03-21T00:00:00", "published": "2015-03-21T00:00:00", "id": "SECURITYVULNS:DOC:31843", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31843", "title": "[Onapsis Security Advisory 2015-001] Multiple Reflected Cross Site Scripting Vulnerabilities in SAP HANA Web-based Development Workbench", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}