CVE-2019-0261

Опубликовано: 15 фев. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).

Ссылки

http://www.securityfocus.com/bid/106986
Third Party Advisory
VDB Entry
https://launchpad.support.sap.com/#/notes/2742027
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
Vendor Advisory
http://www.securityfocus.com/bid/106986
Third Party Advisory
VDB Entry
https://launchpad.support.sap.com/#/notes/2742027
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sap:landscape_management:3.0:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03169

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-306

Связанные уязвимости

GHSA-wvqm-vf4g-854v

CVSS3: 9.8

github

больше 3 лет назад

BDU:2019-01735

CVSS3: 9.1

fstec

почти 7 лет назад

Уязвимость инструмента разработки приложений SAP HANA Extended Application Services системы автоматизации управления SAP Landscape Management, позволяющая нарушителю выполнить произвольный код