CVE-2014-5171

Severity: low (CVSS 2.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-31 · updated 2026-06-17
Weakness: CWE-310

Description

SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Affected products

SAP SE SAP HANA Extended Application Services: all versions

References

http://packetstormsecurity.com/files/127666/SAP-HANA-XS-Missing-Encryption.html
http://scn.sap.com/docs/DOC-8218
http://seclists.org/fulldisclosure/2014/Jul/149
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021
http://www.securityfocus.com/archive/1/532940/100/0/threaded
http://www.securityfocus.com/bid/68947
https://service.sap.com/sap/support/notes/1963932
http://packetstormsecurity.com/files/127666/SAP-HANA-XS-Missing-Encryption.html
http://scn.sap.com/docs/DOC-8218
http://seclists.org/fulldisclosure/2014/Jul/149
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021
http://www.securityfocus.com/archive/1/532940/100/0/threaded

Get alerted when CVE-2014-5171 or the next vulnerability affects your stack