CVE-2017-16687

Current Description

The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be misused to enumerate valid and invalid user accounts. An unauthenticated user could use the error messages to determine if a given username is valid.

Basic Data

Published	December 12, 2017
Last Modified	January 02, 2018
Assigner	cve@mitre.org
Data Type	CVE
Data Format	MITRE
Data Version	4.0
Problem Type	CWE-200
CVE Data Version	4.0

Base Metric V2

CVSS 2 - Version	2.0
CVSS 2 - Vector String	AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS 2 - Access Vector	NETWORK
CVSS 2 - Access Complexity	LOW
CVSS 2 - Authentication	NONE
CVSS 2 - Confidentiality Impact	PARTIAL
CVSS 2 - Availability Impact	NONE
CVSS 2 - Base Score	5.0
Severity	MEDIUM
Exploitability Score	10.0
Impact Score	2.9
Obtain All Privilege	false
Obtain User Privilege	false
Obtain Other Privilege	false

Base Metric V3

CVSS 3 - Version	3.0
CVSS 3 - Vector String	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3 - Attack Vector	NETWORK
CVSS 3 - Attack Complexity	LOW
CVSS 3 - Privileges Required	NONE
CVSS 3 - User Interaction	NONE
CVSS 3 - Scope	UNCHANGED
CVSS 3 - Confidentiality Impact	LOW
CVSS 3 - Integrity Impact	NONE
CVSS 3 - Availability Impact	NONE
CVSS 3 - Base Score	5.3
CVSS 3 - Base Severity	MEDIUM
Exploitability Score	3.9
Base Severity	MEDIUM

Configurations

Vulnerable Software List

Vendor	Product	Versions
Sap	Hana Database	1.00, 2.00

References