PT-2018-15506 · Sap · Sap Hana Extended Application Services

CVE-2018-2373 · Publicado 2018-02-14 · Atualizado 2023-12-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services version 1.0

Description The issue allows unauthenticated users to misuse a specific endpoint of the Controller's API to execute SQL statements, potentially delivering information about system configuration.

Recommendations For SAP HANA Extended Application Services version 1.0, consider restricting access to the vulnerable API endpoint until a patch is available. As a temporary workaround, avoid using the endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2018-2373

Produtos afetados

Sap Hana Extended Application Services

Referências · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-2373 · Aviso do Fabricante
• https://t.me/cvenotify/64604 · Publicação no Telegram
• https://launchpad.support.sap.com/#/notes/2589129 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2373 · Nota de Segurança