CVE-2014-5171

Description

SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

References

https://service.sap.com/sap/support/notes/1963932

http://www.securityfocus.com/bid/68947

http://www.securityfocus.com/archive/1/532940/100/0/threaded

http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021

http://seclists.org/fulldisclosure/2014/Jul/149

http://scn.sap.com/docs/DOC-8218

http://packetstormsecurity.com/files/127666/SAP-HANA-XS-Missing-Encryption.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS