CVE-2024-45277

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
SAP_SE	SAP HANA Client	HDB_CLIENT 2.0
sap_se	sap_hana_client	HDB_CLIENT 2.0

References

https://me.sap.com/notes/3520100Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://www.npmjs.com/package/@sap/hana-client?activeTab=codeProduct

Timeline

Published: Oct 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-452785.4SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After su CVE-2024-452796.1Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthe CVE-2024-45284.8A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as problematic. Affected by this vulnerabilit CVE-2024-452804.8Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login applicati CVE-2024-452815.8SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs CVE-2024-452825.3Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The CVE-2024-452836.0SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password CVE-2024-452842.4An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result i CVE-2024-452855.4The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite no CVE-2024-452866.5Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Ac CVE-2024-452877.5A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than r CVE-2024-452888.4A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.