CVE-2015-3994

medium

Description

The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818.

References

http://www.securityfocus.com/bid/74859

http://www.securityfocus.com/archive/1/535618/100/0/threaded

http://www.onapsis.com/research/security-advisories/SAP-HANA-Log-Injection-Vulnerability-in-Extended-Application-Services

http://seclists.org/fulldisclosure/2015/May/118

http://packetstormsecurity.com/files/132067/SAP-HANA-Log-Injection.html

Details

Source: Mitre, NVD

Published: 2015-05-29

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N