CVE-2019-0261 Auth bypass in SAP HANA Extended Application Services
SAP HANA XS Advanced fails to properly perform authentication checks, allowing unauthorized access to platform and business users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-0261?
CVE-2019-0261 is a critical authentication bypass vulnerability in SAP HANA Extended Application Services, published on 15 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).
Weakness: CWE-306
Which versions are affected by CVE-2019-0261?
It affects 1 product.
Products include Sap Landscape Management.
How do I fix CVE-2019-0261?
No fix has been published for CVE-2019-0261 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-0261 being exploited?
There is no known exploitation of CVE-2019-0261 in the wild and no public exploit code.
Other vulnerabilities in SAP HANA Extended Application Services
- CVE-2019-0249 Information disclosure in SAP Landscape Management(VCM)
- CVE-2020-6191 Command injection in SAP Landscape Management
- CVE-2020-6192 Command injection in SAP Landscape Management
- CVE-2024-39593 [CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management
- CVE-2023-26458 Information Disclosure vulnerability in SAP Landscape Management
Sources
Also known as GHSA-wvqm-vf4g-854v.