Prototype Pollution in SAP Hana-Client
CVE-2024-45277
The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.
Vulnerability class: Prototype Pollution
EPSS: 0.006 (44.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Sap Hana-client
- Sap_se Sap Hana Client — versions HDB_CLIENT 2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
- cna@sap.com (Product)
Frequently asked questions
- What is CVE-2024-45277?
- CVE-2024-45277 is a medium-severity vulnerability in SAP Hana-Client, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 4.3/10. Published 2024-10-08.
- How severe is CVE-2024-45277?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2024-45277 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.