CVE-2019-0364

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-10 · updated 2026-06-17

Description

Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports.

Affected products

SAP SE SAP HANA Extended Application Services: before 1.0.118 — fixed in 1.0.118

How to fix

Upgrade to a fixed version: SAP SE SAP HANA Extended Application Services 1.0.118. Check the vendor advisory for mitigations.

References

https://launchpad.support.sap.com/#/notes/2817491
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
https://launchpad.support.sap.com/#/notes/2817491
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506

Get alerted when CVE-2019-0364 or the next vulnerability affects your stack