Hana Extended Application Services vulnerabilities

Product

Hana Extended Application Services

by Sap · last CVE Sep 10, 2019

CVEs

On KEV

8.1

Max CVSS

New 30D

Vulnerabilities18 In the news0 Timeline

Severity mix

Critical 0High 6Medium 9Low 0

Severity

All severities18 Critical0 High6 Medium9 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Hana Extended Application Services to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2018-2451	6.6	1%	Aug 14	XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolonged period of… Affected: 1.0
CVE-2019-0277	6.5	2%	Mar 12	SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP… Affected: 1.0
CVE-2018-2379	6.5	1%	Feb 14	In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint Affected: 1.0
CVE-2018-2378	6.5	1%	Feb 14	In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption Affected: 1.0
CVE-2018-2377	6.5	1%	Feb 14	In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users Affected: 1.0
CVE-2018-2374	6.5	1%	Feb 14	In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service… Affected: 1.0
CVE-2018-2372	6.5	1%	Feb 14	A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communication Affected: 1.0
CVE-2019-0364	4.3	1%	Sep 10	Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports Affected: before 1.0.118
CVE-2019-0306	4.3	1%	Jun 12	SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to… Affected: 1.0