PT-2018-15496 · Sap · Sap Hana

Published 2018-01-09 · Updated 2020-08-24 · CVE-2018-2362

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA versions 1.00 through 2.00

Description A remote unauthenticated attacker could send specially crafted SOAP requests to the SAP Startup Service, potentially disclosing sensitive information such as the platform's hostname.

Recommendations For SAP HANA versions 1.00 through 2.00, consider restricting access to the SAP Startup Service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2018-2362

Affected Products

Sap Hana

References · 5

• https://osv.dev/vulnerability/CVE-2018-2362 · Vendor Advisory
• https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2362 · Security Note
• https://launchpad.support.sap.com/#/notes/2575750 · Note
• http://securityfocus.com/bid/102452 · Note