CVE-2018-2402
CVSS V2 Low 3.5
CVSS V3 High 8.4
Description
In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.
Overview
- CVE ID
- CVE-2018-2402
- Assigner
- cna@sap.com
- Vulnerability Status
- Modified
- Published Version
- 2018-03-14T19:29:00
- Last Modified Date
- 2019-10-09T23:40:03
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:sap:hana:1.00:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:hana:2.00:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:S/C:P/I:N/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- SINGLE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 3.5
- Severity
- LOW
- Exploitability Score
- 6.8
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- HIGH
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 8.4
- Base Severity
- HIGH
- Exploitability Score
- 1.7
- Impact Score
- 6
References
| Reference URL | Reference Tags |
|---|---|
| https://launchpad.support.sap.com/#/notes/2587369 | Permissions Required Vendor Advisory |
| https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ | Vendor Advisory |
| http://www.securityfocus.com/bid/103369 | Third Party Advisory VDB Entry |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2018-2402 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2402 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:04:12 | Added to TrackCVE | |||
| 2022-12-03 03:28:30 | 2018-03-14T19:29Z | 2018-03-14T19:29:00 | CVE Published Date | updated |
| 2022-12-03 03:28:30 | 2019-10-09T23:40:03 | CVE Modified Date | updated | |
| 2022-12-03 03:28:30 | Modified | Vulnerability Status | updated |