CVEvulnerability
CVE-2016-6150
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2016-08-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-284
Description
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.
Affected configurations
• sap hana
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://packetstormsecurity.com/files/138453/SAP-HANA-DB-Encryption-Issue.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2016/Aug/96 seclists.org
- http://www.securityfocus.com/bid/92064 Third Party Advisory, VDB Entry
- https://layersevensecurity.com/wp-content/uploads/2016/02/Layer-Seven-Security_SAP-Security-Notes_January-2016.pdf Technical Description, Third Party Advisory
- https://www.onapsis.com/research/security-advisories/sap-hana-potential-wrong-encryption Permissions Required, Third Party Advisory
- http://packetstormsecurity.com/files/138453/SAP-HANA-DB-Encryption-Issue.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2016/Aug/96 seclists.org
- http://www.securityfocus.com/bid/92064 Third Party Advisory, VDB Entry
- https://layersevensecurity.com/wp-content/uploads/2016/02/Layer-Seven-Security_SAP-Security-Notes_January-2016.pdf Technical Description, Third Party Advisory
- https://www.onapsis.com/research/security-advisories/sap-hana-potential-wrong-encryption Permissions Required, Third Party Advisory