Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-6150

The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.

Published

2016-08-05T14:59:24.190

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-284

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sap	hana	-	Yes

References

http://packetstormsecurity.com/files/138453/SAP-HANA-DB-Encryption-Issue.html ([email protected])
http://seclists.org/fulldisclosure/2016/Aug/96 ([email protected])
http://www.securityfocus.com/bid/92064 Third Party Advisory, VDB Entry ([email protected])
https://layersevensecurity.com/wp-content/uploads/2016/02/Layer-Seven-Security_SAP-Security-Notes_January-2016.pdf Technical Description, Third Party Advisory ([email protected])
https://www.onapsis.com/research/security-advisories/sap-hana-potential-wrong-encryption Permissions Required, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/138453/SAP-HANA-DB-Encryption-Issue.html (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2016/Aug/96 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/92064 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://layersevensecurity.com/wp-content/uploads/2016/02/Layer-Seven-Security_SAP-Security-Notes_January-2016.pdf Technical Description, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.onapsis.com/research/security-advisories/sap-hana-potential-wrong-encryption Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)