Detections
Analytics

CVE-2016-3640

medium

Description

The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.091.00.1418659308 allows local users to obtain sensitive password information via vectors related to passwords in Web Dispatcher trace files, aka SAP Security Note 2148905.

References

https://www.onapsis.com/research/security-advisories/sap-hana-password-disclosure

https://www.onapsis.com/blog/analyzing-sap-security-notes-august-2015-edition

http://www.securityfocus.com/bid/92068

https://layersevensecurity.com/wp-content/uploads/2015/10/Layer-Seven-Security_SAP-Security-Notes_August-2015.pdf

Details

Source: Mitre, NVD

Published: 2016-08-05

Updated: 2026-05-06

Risk Information

CVSS v2

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Severity: Low

CVSS v3

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

EPSS

EPSS: 0.0011