CVE-2015-1311
HighSummary
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors.
Risk Assessment
Attackers may exploit this vulnerability to execute malicious code, potentially leading to serious security breaches in the SAP HANA system.
Recommendation
It is recommended to update SAP HANA to the latest version and monitor logs for unauthorized access attempts.
Other vulnerabilities in SAP HANA
See all- CVE-2026-0492High
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.
- CVE-2016-6144High
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as 'False'. This makes it easier for remote attackers to bypass authentication via a brute force attack.
- CVE-2015-7986High
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request.
- CVE-2014-8588High
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-6150Critical
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
- CVE-2016-1929Critical
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.
Original NVD description (English source)
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.