CVE-2015-3994

Published: May 29, 2015Modified: May 6, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818.

Affected (1)

Products: Sap: Hana

Sap

1 product

Hana

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sap Hana	Version 1.00.73.00.389160

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://packetstormsecurity.com/files/132067/SAP-HANA-Log-Injection.html

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2015/May/118

Source: cve@mitre.org

http://www.onapsis.com/research/security-advisories/SAP-HANA-Log-Injection-Vulnerability-in-Extended-Application-Services

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/535618/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/74859

Source: cve@mitre.org

http://packetstormsecurity.com/files/132067/SAP-HANA-Log-Injection.html