CVE-2016-6144
HighSummary
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as 'False'. This makes it easier for remote attackers to bypass authentication via a brute force attack.
Risk Assessment
The lack of login attempt restrictions poses a risk that attackers may gain access to the SYSTEM account, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to update SAP HANA to a version that supports login attempt restrictions for the SYSTEM user and to configure the password_lock_for_system_user option to 'True'.
Other vulnerabilities in SAP HANA
See all- CVE-2026-0492High
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.
- CVE-2015-7986High
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request.
- CVE-2015-1311High
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors.
- CVE-2014-8588High
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-6150Critical
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
- CVE-2016-1929Critical
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.
Original NVD description (English source)
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869.