{"schemaVersion":3,"id":"CVE-2019-0261","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).","dates":{"published":"2019-02-15T18:00:00.000Z","modified":"2024-08-04T17:44:16.376Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03629,"percentile":0.8947,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.9340000000000002,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.02695},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.03629,"percentile":0.8947}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.03629,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.03629,"percentile":0.8947}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"sap se","product":"sap hana extended application services","name":"SAP HANA Extended Application Services","label":"sap hana extended application services","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP                                                                                                               HANA 2 SPS0 (second S stands for stack)","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP                                                                                                               HANA 2 SPS0 (second S stands for stack)","eol":null,"hubHref":"/vendor/sap_se/sap_hana_extended_application_services"},{"vendor":"sap","product":"landscape_management","name":"landscape management","label":"landscape_management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.0","eol":null,"hubHref":"/vendor/sap/landscape_management"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943","label":"wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943","hostname":"wiki.scn.sap.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2742027","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["X Refsource MISC","Permissions Required","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/106986","label":"www.securityfocus.com/bid/106986","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-02-15T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T17:44:16.376Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T05:37:12.185Z","stale":false,"partial":false}}