CVE-2016-6145

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailed_error_on_connect option is not supported or is configured as "False," which allows remote attackers to enumerate database users via a series of login attempts, aka SAP Security Note 2216869.

• CWE-200

• http://packetstormsecurity.com/files/138444/SAP-HANA-DB-1.00.091.00.1418659308-Information-Disclosure.html
• http://seclists.org/fulldisclosure/2016/Aug/92Third Party Advisory
• http://www.securityfocus.com/bid/92346
• https://www.onapsis.com/blog/onapsis-publishes-15-advisories-sap-hana-and-building-componentsThird Party Advisory
• https://www.onapsis.com/research/security-advisories/sap-hana-user-information-disclosurePermissions Required
• http://packetstormsecurity.com/files/138444/SAP-HANA-DB-1.00.091.00.1418659308-Information-Disclosure.html
• http://seclists.org/fulldisclosure/2016/Aug/92Third Party Advisory
• http://www.securityfocus.com/bid/92346
• https://www.onapsis.com/blog/onapsis-publishes-15-advisories-sap-hana-and-building-componentsThird Party Advisory
• https://www.onapsis.com/research/security-advisories/sap-hana-user-information-disclosurePermissions Required

Published

Aug 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6138Directory traversal vulnerability in SAP TREX 7.10 Revision …
• CVE-2016-6139SAP TREX 7.10 Revision 63 allows remote attackers to read ar…
• CVE-2016-6140SAP TREX 7.10 Revision 63 allows remote attackers to write t…
• CVE-2016-6142SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote a…
• CVE-2016-6143SAP HANA DB 1.00.73.00.389160 allows remote attackers to exe…
• CVE-2016-6144The SQL interface in SAP HANA before Revision 102 does not l…
• CVE-2016-6146The NameServer in SAP TREX 7.10 Revision 63 allows remote at…
• CVE-2016-6147An unspecified interface in SAP TREX 7.10 Revision 63 allows…
• CVE-2016-6148SAP HANA DB 1.00.73.00.389160 allows remote attackers to cau…
• CVE-2016-6149SAP HANA SPS09 1.00.091.00.14186593 allows local users to ob…
• CVE-2016-6150The multi-tenant database container feature in SAP HANA does…
• CVE-2016-6151CA eHealth 6.2.x allows remote authenticated users to cause …