vulnwire
8.3high

CVE-2017-8914

sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an inse…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known

sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.

Exploit prediction (EPSS)

1.49% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • securityfocus.com /bid/96206 · vdb-entry, x_refsource_BID, x_transferred
  • erpscan.io /advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/ · x_refsource_MISC, x_transferred
  • erpscan.io /press-center/blog/sap-cyber-threat-intelligence-report-february-2017/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.