CVE-2014-5171

SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Score

CVSS 2.0 2.9 Low

Status

Modified - cve@mitre.org

Published

2014-07-31

Last modified

2024-10-21

Weaknesses

CWE-310

Affected products

• Hana Extended Application Services (Sap)

References

• http://packetstormsecurity.com/files/127666/SAP-HANA-XS-Missing-Encryption.html
• http://scn.sap.com/docs/DOC-8218
• http://seclists.org/fulldisclosure/2014/Jul/149
• http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021
• http://www.securityfocus.com/archive/1/532940/100/0/threaded
• http://www.securityfocus.com/bid/68947
• https://service.sap.com/sap/support/notes/1963932