PT-2019-4581 · Sap · Sap Hana Extended Application Services

Published 2019-06-12 · Updated 2020-08-24 · CVE-2019-0306

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services (advanced model) version 1

Description The issue is related to a lack of protection for service data in the SAP HANA Extended Application Services development tool. This allows an attacker to gain unauthorized access to a list of SAP HANA user IDs and names. Authenticated low-privileged users, such as SpaceAuditors, can execute requests to obtain this sensitive information.

Recommendations For SAP HANA Extended Application Services (advanced model) version 1, consider restricting access to the service data to minimize the risk of exploitation. As a temporary workaround, limit the privileges of low-privileged users, such as SpaceAuditors, to prevent them from executing requests that could lead to unauthorized access to user IDs and names. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-00641

CVE-2019-0306

Affected Products

Sap Hana Extended Application Services

References · 6

• https://bdu.fstec.ru/vul/2020-00641 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0306 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0306 · Security Note
• https://launchpad.support.sap.com/#/notes/2771128 · Vendor Advisory
• https://threatpost.ru/sap-published-june-patch-notes/33079 · Note