CVE-2017-8914

sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.

Score

CVSS 3.0 8.3 High

Status

Modified - cve@mitre.org

Published

2017-05-23

Last modified

2024-08-05

Affected products

• Hana Xs (Sap)

References

• http://www.securityfocus.com/bid/96206
• https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/
• https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/