CVE-2014-8588
HighSummary
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Risk Assessment
Attackers may exploit this vulnerability to gain control over the database, potentially leading to data loss or confidentiality breaches.
Recommendation
It is recommended to update SAP HANA to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in SAP HANA 1.00.60.379371
See all- CVE-2026-0492High
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.
- CVE-2016-6144High
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as 'False'. This makes it easier for remote attackers to bypass authentication via a brute force attack.
- CVE-2015-7986High
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request.
- CVE-2015-1311High
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors.
- CVE-2016-6150Critical
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
- CVE-2016-1929Critical
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.
Original NVD description (English source)
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.