CVE-2016-6142

EUVD-2016-7076
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors related to the SQL protocol, aka SAP Security Note 2197459.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
Affected Products (NVD)
VendorProductVersion
saphana
1.00.73.00.389160
𝑥
= Vulnerable software versions
References
http://onapsis.com/research/security-advisories/sap-hana-arbitrary-audit-injection-sql-protocol
http://packetstormsecurity.com/files/138441/SAP-HANA-DB-1.00.73.00.389160-SAP-Protocol-Audit-Injection.html
http://seclists.org/fulldisclosure/2016/Aug/89
http://www.securityfocus.com/bid/92566
http://onapsis.com/research/security-advisories/sap-hana-arbitrary-audit-injection-sql-protocol
http://packetstormsecurity.com/files/138441/SAP-HANA-DB-1.00.73.00.389160-SAP-Protocol-Audit-Injection.html
http://seclists.org/fulldisclosure/2016/Aug/89
http://www.securityfocus.com/bid/92566