{"api_version":"1","generated_at":"2026-04-23T05:06:45+00:00","cve":"CVE-2019-0261","urls":{"html":"https://cve.report/CVE-2019-0261","api":"https://cve.report/api/cve/CVE-2019-0261.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-0261","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0261"},"summary":{"title":"CVE-2019-0261","description":"Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2019-02-15 18:29:00","updated_at":"2020-08-24 17:37:00"},"problem_types":["CWE-306"],"metrics":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2742027","name":"https://launchpad.support.sap.com/#/notes/2742027","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – February 2019 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/106986","name":"106986","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"SAP HANA CVE-2019-0261 Authentication Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0261","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0261","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"261","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"landscape_management","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"261","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"landscape_management","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2019-0261","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP HANA Extended Application Services","version":{"version_data":[{"version_name":"<","version_value":"1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP                                                                                                               HANA 2 SPS0 (second S stands for stack)"}]}}]},"vendor_name":"SAP SE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack))."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Missing Authentication Check"}]}]},"references":{"reference_data":[{"name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943","refsource":"MISC","url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943"},{"name":"https://launchpad.support.sap.com/#/notes/2742027","refsource":"MISC","url":"https://launchpad.support.sap.com/#/notes/2742027"},{"name":"106986","refsource":"BID","url":"http://www.securityfocus.com/bid/106986"}]}},"nvd":{"publishedDate":"2019-02-15 18:29:00","lastModifiedDate":"2020-08-24 17:37:00","problem_types":["CWE-306"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:landscape_management:3.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"261","Ordinal":"136669","Title":"CVE-2019-0261","CVE":"CVE-2019-0261","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"261","Ordinal":"1","NoteData":"Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).","Type":"Description","Title":null},{"CveYear":"2019","CveId":"261","Ordinal":"2","NoteData":"2019-02-15","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"261","Ordinal":"3","NoteData":"2019-02-16","Type":"Other","Title":"Modified"}]}}}