User Account Enumeration Vulnerability in SAP HANA Database by SAP

CVE-2017-16687

Summary

The self-service tools within SAP HANA extended application services, specifically the classic user self-service functionality, are susceptible to abuse. An attacker could exploit this vulnerability to enumerate valid and invalid user accounts by analyzing error messages. This could allow unauthorized users to gain insights into existing accounts, facilitating further attacks. Effective access controls and error handling are critical to mitigate this risk.

References