{"id":"CVE-2024-45277","state":"PUBLISHED","title":"Prototype Pollution vulnerability in SAP HANA Client","description":"The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.","publishedAt":"2024-10-08T03:21:16.236Z","updatedAt":"2024-10-08T14:01:44.271Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"sap"},"assigner":"sap","products":["SAP_SE SAP HANA Client"],"affected":[{"vendor":"SAP_SE","product":"SAP HANA Client","defaultStatus":"unaffected","versions":[{"version":"HDB_CLIENT 2.0","status":"affected"}]}],"references":["https://me.sap.com/notes/3520100","https://url.sap/sapsecuritypatchday","https://www.npmjs.com/package/@sap/hana-client?activeTab=code"],"weaknesses":["CWE-1321"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/45xxx/CVE-2024-45277.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-45277","state":"PUBLISHED","datePublished":"2024-10-08T03:21:16.236Z","dateUpdated":"2024-10-08T14:01:44.271Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2024-08-26T10:39:20.931Z"},"containers":{"cna":{"title":"Prototype Pollution vulnerability in SAP HANA Client","descriptions":[{"lang":"en","value":"The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity."}],"affected":[{"vendor":"SAP_SE","product":"SAP HANA Client","defaultStatus":"unaffected","versions":[{"version":"HDB_CLIENT 2.0","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3520100"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://www.npmjs.com/package/@sap/hana-client?activeTab=code"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1321","description":"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes","lang":"eng","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2024-10-08T09:52:33.850Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sap_se","product":"sap_hana_client","defaultStatus":"unknown","versions":[{"version":"HDB_CLIENT 2.0","status":"affected"}],"cpes":["cpe:2.3:a:sap_se:sap_hana_client:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-08T13:59:56.396341Z","id":"CVE-2024-45277","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-08T14:01:44.271Z"}}]}}}