Vulnerability · Published Oct 8, 2024 · Assigned by sap

CVE-2024-45277Prototype Pollution vulnerability in SAP HANA Client

Medium 4.3

In plain English

A medium-severity prototype pollution in SAP HANA Client from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@sap/hana-client	2.21.31	GHSA-6339-gv7w-g5f4

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP HANA Client	HDB_CLIENT 2.0

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References