Prototype Pollution in SAP Hana-Client
CVE-2024-45277
The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.
Vulnerability class: Prototype Pollution
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.006 (46.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- SAP Hana-Client
- SAP Se Hana Client — versions HDB_CLIENT 2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- me.sap.com/notes/3520100 (Permissions Required)
- url.sap/sapsecuritypatchday (Vendor Advisory)
- www.npmjs.com/package/@sap/hana-client (Product)
Frequently asked questions
- What is CVE-2024-45277?
- CVE-2024-45277 is a medium-severity vulnerability in SAP Hana-Client, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 4.3/10. Published 2024-10-08.
- How severe is CVE-2024-45277?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2024-45277 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.