PT-2018-15573 · Sap · Sap Hana Extended Application Services

Publicado 2018-08-14 · Atualizado 2020-08-24 · CVE-2018-2451

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services (XS) version 1

Description The XS Command-Line Interface (CLI) user sessions may have an unintentional prolonged period of validity, allowing a platform user to access controller resources via an active CLI session even after authorizations have been revoked by an administrator. An attacker who gains access to the platform user's session could misuse the session token even after the session has been closed.

Recommendations For SAP HANA Extended Application Services (XS) version 1, consider restricting access to the CLI until a fix is available to prevent unauthorized use of session tokens. As a temporary workaround, regularly close and re-authenticate CLI sessions to minimize the risk of exploitation.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2018-2451

Produtos afetados

Sap Hana Extended Application Services

Referências · 5

• http://securityfocus.com/bid/105091 · Nota
• https://osv.dev/vulnerability/CVE-2018-2451 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2590705 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2451 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 · Aviso do Fabricante