CVE-2020-26834

SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manipulate a valid existing SAML bearer token to authenticate as a user whose name is identical to the truncated username for whom the SAML bearer token was issued.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cna@sap.com

Published

2020-12-09

Last modified

2024-08-04

Weaknesses

CWE-287

Affected products

• Hana Database (Sap)
• Sap Hana Database (Sap Se)

References

• https://launchpad.support.sap.com/#/notes/2978768
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079