SAP Hana Database
By the Year
In 2024 there have been 0 vulnerabilities in SAP Hana Database . Last year Hana Database had 2 security vulnerabilities published. Right now, Hana Database is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 2 | 8.65 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 6.50 |
| 2020 | 1 | 5.40 |
| 2019 | 1 | 7.50 |
| 2018 | 1 | 7.50 |
It may take a day or so for new Hana Database vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent SAP Hana Database Security Vulnerabilities
SAP CommonCryptoLib does not perform necessary authentication checks
CVE-2023-40309
9.8 - Critical
- September 12, 2023
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
AuthZ
SAP CommonCryptoLib
CVE-2023-40308
7.5 - High
- September 12, 2023
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.
NULL Pointer Dereference
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way
CVE-2021-21474
6.5 - Medium
- February 09, 2021
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database.
Inadequate Encryption Strength
SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication
CVE-2020-26834
5.4 - Medium
- December 09, 2020
SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manipulate a valid existing SAML bearer token to authenticate as a user whose name is identical to the truncated username for whom the SAML bearer token was issued.
authentification
SAP HANA Database, versions 1.0, 2.0
CVE-2019-0350
7.5 - High
- November 04, 2019
SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service
SAP UI5 did not validate user input before adding it to the DOM structure
CVE-2018-2424
7.5 - High
- June 12, 2018
SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for SAP Ui or by SAP? Click the Watch button to subscribe.
