SQL Injection in SAP Hana

CVE-2015-7727

Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the (1) trace configuration page or (2) getSqlTraceConfiguration function, aka SAP Security Note 2153898.

Vulnerability class: SQL Injection

EPSS: 0.013 (68.1th percentile) — read the EPSS interpretation.

Affected products

  • Sap Hana — versions 1.00.73.00.389160
  • N/a — versions n/a

Weakness classification (CWE)

References