Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

SAP HANA XS Advanced lets low‑privilege users see all users

CVE-2019-0306 · published 7 years ago
Summary

In SAP HANA Extended Application Services (advanced model) version 1, a user with a low‑level role such as SpaceAuditor can request a list that reveals every user ID and name in the database. This exposure could help an attacker map the system’s accounts and plan further attacks. Limit the roles that can run such requests, apply the latest security patches, and review user permissions regularly.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap hana_extended_application_services 1.0
cpe:2.3:a:sap:hana_extended_application_services:1.0:*:*:*:*:*:*:*
Original advisory text
SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete lis...
SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published12 Jun 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-0306 · NVD
Track software like this
Free during beta