CVE-2015-7994

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428.

La interfaz SQL en SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados relacionados con 'SQL Login,' también conocida como SAP Security Note 2197428.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-10-28 CVE Reserved
2015-11-09 CVE Published
2023-12-10 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (4)

URL	Tag	Source
http://packetstormsecurity.com/files/134287/SAP-HANA-SQL-Login-Remote-Code-Execution.html	X_refsource_misc
http://seclists.org/fulldisclosure/2015/Nov/40	Mailing List
https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015	X_refsource_misc
https://www.onapsis.com/research/security-advisories/SAP_HANA_Remote_Code_Execution_SQL_based	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sap Search vendor "Sap"		Hana Search vendor "Sap" for product "Hana"				1.00.73.00.389160 Search vendor "Sap" for product "Hana" and version "1.00.73.00.389160"		-		Affected