Unscored severity · published Jul 31, 2014
CVE-2014-5171
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain…
–
CVSS
1.5%
EPSS
No
On KEV
Description
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Hana Extended Application Services · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5171
packetstormsecurity.com
http://packetstormsecurity.com/files/127666/SAP-HANA-XS-Missing-Encryption.html
scn.sap.com
http://scn.sap.com/docs/DOC-8218
seclists.org
http://seclists.org/fulldisclosure/2014/Jul/149
www.onapsis.com
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021
www.securityfocus.com
http://www.securityfocus.com/archive/1/532940/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/68947
More from Hana Extended Application Services
8.1
CVE-2018-2376
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space
8.1
CVE-2018-2375
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space
7.5
CVE-2019-0266
Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA…
7.5
CVE-2018-2373
Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system…
7.5
CVE-2017-16680
Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input…