Authorization

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...

CVE-2018-2378

In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption...

CVE-2018-2378

In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption...

CVE-2018-2378

In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption...

CVE-2018-2375

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...

CVE-2018-2377

In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users...

CVE-2018-2372

A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communication...

CVE-2018-2373

Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP HANA Extended Application Services, 1.0...

CVE-2018-2374

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space...

CVE-2018-2379

In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint...

CVE-2018-2376

CVE-2018-2376 affects SAP HANA Extended Application Services 1.0. a controller user with SpaceAuditor authorization in a specific space could retrieve application environments within that space. No exploitation details are provided in the documents; remediation guidance (from PT-2018-15509) sugge...

CVE-2018-2377

The CVE-2018-2377 issue affects SAP HANA Extended Application Services 1.0. It allows unauthorized users to retrieve some general server statistics and status information, indicating a partial confidentiality impact. Root cause details are not explicitly provided beyond exposure of server metadat...

CVE-2018-2375

Affected software: SAP HANA Extended Application Services 1.0. Description: a controller user with SpaceAuditor authorization in a given space could retrieve application environments within that space. Impact: authorized user could access environment data across the space; exploitation status not...

CVE-2018-2374

CVE-2018-2374 affects SAP HANA Extended Application Services (EAS) 1.0. A controller user with SpaceAuditor authorization in a specific space could retrieve sensitive data (e.g., service bindings) within that space. Root cause is insufficient access restrictions for SpaceAuditor scoped users. Imp...

CVE-2018-2373

CVE-2018-2373 affects SAP HANA Extended Application Services (EAS) version 1.0. The vulnerability arises from a misusable endpoint of the Controller API that, when accessed by unauthenticated users, can execute SQL statements and disclose information about system configuration. Affected component...

CVE-2018-2378

SAP HANA Extended Application Services (EAS) 1.0 is affected by CVE-2018-2378, where unauthorized users can read statistical data about deployed applications, including resource consumption (information disclosure). The exact root cause, exploitable vectors, and fixes are not detailed in the prov...

CVE-2018-2376

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...

CVE-2018-2372

This CVE concerns SAP HANA Extended Application Services (SAP HANA XAS) 1.0, where a plaintext keystore password is written to a system log file. The underlying issue is exposure of sensitive credentials via logs, potentially compromising SSL confidentiality. Affected component/file: keystore/pas...

PT-2018-15506 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extended Application Services version 1.0 Description: The issue allows unauthenticated users to misuse a specific endpoint of the Controller's API to execute SQL statements, potentially delivering information about system...

PT-2018-15505 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extended Application Services version 1.0 Description: A plain keystore password is written to a system log file, which could endanger the confidentiality of SSL communication. Recommendations: For SAP HANA Extended Application...