CVE-2015-7828: Input Validation
SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the (1) fcopydir, (2) fmkdir, (3) frmdir, (4) getenv, (5) dumpenv, (6) fcopy, (7) fput, (8) fdel, (9) fmove, (10) fget, (11) fappend, (12) fdir, (13) getTraces, (14) kill, (15) pexec, (16) stop, or (17) pythonexec method, aka SAP Security Note 2165583.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7828?
CVE-2015-7828 has a critical severity level due to the lack of authentication allowing remote code execution.
How do I fix CVE-2015-7828?
To fix CVE-2015-7828, upgrade to SAP HANA Database version 1.00 SPS11 or later.
What software is affected by CVE-2015-7828?
CVE-2015-7828 affects SAP HANA Database versions 1.00 SPS10 and earlier.
What type of attacks can exploit CVE-2015-7828?
CVE-2015-7828 can be exploited by remote attackers to execute arbitrary code via TrexNet packets.
Is authentication required for accessing SAP HANA Database when CVE-2015-7828 is present?
No, CVE-2015-7828 indicates that authentication is not required, allowing unauthorized access.