Information disclosure in SAP HANA XS classic user self service, SAP security note 2394445

SAP security note 2394445, "Information Disclosure in SAP HANA XS Classic User Self Service", is a program error note released on 13.12.2016. Below are the symptom and SAP recommended solution.

Description

Symptom

A remote unauthenticated attacker can obtain a list of users in SAP HANA by exploiting the password recovery functionality provided by the user self service application. This application returns detailed messages that may reveal the existence of a user.

Solution

SAP has improved the messages of the user self service application in the following updates:

• SAP HANA 1.0 Revision 112.07 (for SPS11)
• SAP HANA 1.0 Revision 122.04 (for SPS12)

Please update to these or later versions to mitigate the vulnerability.

Reason and prerequisites

The user self service application is based on the Extended Application Services (XS classic model) and is disabled by default. The password reset functionality can only be exploited if the user self service application is enabled.

CVSS

Score 5.3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N