CVE-2024-45277

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3520100	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory
https://www.npmjs.com/package/@sap/hana-client?activeTab=code	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:hana-client:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2024-10-08 04:15

Updated : 2024-11-14 17:54

NVD link : CVE-2024-45277

Mitre link : CVE-2024-45277

CVE.ORG link : CVE-2024-45277

JSON object : View

Products Affected

sap

hana-client

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2024-45277", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-10-08T04:15:08.133", "references": [{"url": "https://me.sap.com/notes/3520100", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://www.npmjs.com/package/@sap/hana-client?activeTab=code", "tags": ["Product"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity."}, {"lang": "es", "value": "Las versiones del paquete de cliente SAP HANA Node.js de la 2.0.0 anterior a la 2.21.31 se ven afectadas por la vulnerabilidad de contaminaci\u00f3n de prototipos, que permite a un atacante agregar propiedades arbitrarias a los prototipos de objetos globales. Esto se debe a una desinfecci\u00f3n inadecuada de la entrada del usuario al utilizar la funci\u00f3n nestTables, lo que tiene un impacto bajo en la disponibilidad de la aplicaci\u00f3n. Esto no tiene impacto en la confidencialidad ni la integridad."}], "lastModified": "2024-11-14T17:54:28.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:hana-client:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F5C1E6EC-59D6-4B6B-AEFA-5CA4E39D8AC2", "versionEndExcluding": "2.21.31", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}