CVE-2019-0363

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-10 · updated 2026-06-17

Description

Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrieve information about internal network ports.

Affected products

SAP SE SAP HANA Extended Application Services: before 1.0.118 — fixed in 1.0.118

How to fix

Upgrade to a fixed version: SAP SE SAP HANA Extended Application Services 1.0.118. Check the vendor advisory for mitigations.

References

https://launchpad.support.sap.com/#/notes/2817491
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
https://launchpad.support.sap.com/#/notes/2817491
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506

Get alerted when CVE-2019-0363 or the next vulnerability affects your stack