CVE-2016-6144

The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869.

• CWE-284

• http://packetstormsecurity.com/files/138443/SAP-HANA-DB-1.00.73.00.389160-SYSTEM-User-Brute-Force.html
• http://seclists.org/fulldisclosure/2016/Aug/91
• http://www.securityfocus.com/bid/92065Third Party Advisory, VDB Entry
• https://www.onapsis.com/blog/onapsis-publishes-15-advisories-sap-hana-and-building-componentsThird Party Advisory
• https://www.onapsis.com/research/security-advisories/sap-hana-system-user-brute-force-attackPermissions Required
• http://packetstormsecurity.com/files/138443/SAP-HANA-DB-1.00.73.00.389160-SYSTEM-User-Brute-Force.html
• http://seclists.org/fulldisclosure/2016/Aug/91
• http://www.securityfocus.com/bid/92065Third Party Advisory, VDB Entry
• https://www.onapsis.com/blog/onapsis-publishes-15-advisories-sap-hana-and-building-componentsThird Party Advisory
• https://www.onapsis.com/research/security-advisories/sap-hana-system-user-brute-force-attackPermissions Required

Published

Aug 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6137An unspecified function in SAP TREX 7.10 Revision 63 allows …
• CVE-2016-6138Directory traversal vulnerability in SAP TREX 7.10 Revision …
• CVE-2016-6139SAP TREX 7.10 Revision 63 allows remote attackers to read ar…
• CVE-2016-6140SAP TREX 7.10 Revision 63 allows remote attackers to write t…
• CVE-2016-6142SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote a…
• CVE-2016-6143SAP HANA DB 1.00.73.00.389160 allows remote attackers to exe…
• CVE-2016-6145The SQL interface in SAP HANA DB 1.00.091.00.1418659308 prov…
• CVE-2016-6146The NameServer in SAP TREX 7.10 Revision 63 allows remote at…
• CVE-2016-6147An unspecified interface in SAP TREX 7.10 Revision 63 allows…
• CVE-2016-6148SAP HANA DB 1.00.73.00.389160 allows remote attackers to cau…
• CVE-2016-6149SAP HANA SPS09 1.00.091.00.14186593 allows local users to ob…
• CVE-2016-6150The multi-tenant database container feature in SAP HANA does…