CVE-2019-0261
9.8
CRITICAL · CVSS 3.0 · EPSS 3.6% (pctl 89)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.63% — more likely to be exploited than 89% of all CVEs |
| Weakness | CWE-306 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-02-15 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| sap | landscape management |
References
- http://www.securityfocus.com/bid/106986
- https://launchpad.support.sap.com/#/notes/2742027
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
- http://www.securityfocus.com/bid/106986
- https://launchpad.support.sap.com/#/notes/2742027
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
→ the Explorer · watch your stack · NVD