CVE Vulnerabilities

CVE-2019-0266

Insertion of Sensitive Information into Log File

Published: Feb 15, 2019 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased.

Weakness

The product writes sensitive information to a log file.

Affected Software

Name Vendor Start Version End Version
Hana_extended_application_services Sap 1.0 (including) 1.0 (including)

Potential Mitigations

References