CVE-2017-8914

Severity: high (CVSS 8.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-23 · updated 2026-06-17

Description

sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.

Affected products

SAP Hana Xs: 1.00, 2.00

References

http://www.securityfocus.com/bid/96206
https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/
https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/
http://www.securityfocus.com/bid/96206
https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/
https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/

Get alerted when CVE-2017-8914 or the next vulnerability affects your stack