Critical severity · published Feb 15, 2019
CVE-2019-0261
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and…
9.8
CVSS
3.6%
EPSS
No
On KEV
Description
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
SAP HANA Extended Application Services · SAP SE
< 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack) · source: vendor
LM
Landscape Management · Sap
3.0 · source: NVD
Affected product
SH
SAP HANA Extended Application Services
SAP SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0261
Third Party Advisory
http://www.securityfocus.com/bid/106986
Permissions Required
https://launchpad.support.sap.com/#/notes/2742027
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
More from SAP HANA Extended Application Services
6.5
CVE-2019-0277
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP…