CVE-2014-5171: SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form...

Security readout for executives and security teams

SAP HANA XS applications using form-based authentication may send credentials or sensitive data without proper encryption. An attacker with network visibility could capture those values in transit. The source bundle does not provide affected versions, CVSS, or confirmed public exploitation. Exposure is most likely where SAP HANA XS applications use form-based authentication and traffic crosses shared, hostile, or insufficiently trusted networks. Internet-facing, partner-facing, or poorly segmented deployments carry greater business risk. Prioritize if SAP HANA XS supports business-critical workflows or is reachable beyond tightly controlled networks. Credential exposure can lead to unauthorized access, but urgency depends on deployment scope because affected versions and exploit activity are not confirmed in the bundle. Mitigation focus: Review SAP Note 1963932 and Onapsis advisory 2014-021 for vendor-approved remediation.; Inventory SAP HANA XS applications using form-based authentication.; Restrict HANA XS access to trusted networks until remediation is verified..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.