PT-2018-15502 · Sap · Sap Hana

Published 2018-02-14 · Updated 2020-08-24 · CVE-2018-2369

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA versions 1.00 through 2.00

Description The issue allows an unauthenticated attacker to access restricted information under certain conditions. It is related to the authentication function of the SAP HANA server on its SQL interface, which can disclose 8 bytes of the server process memory. However, the attacker cannot influence or predict the location of the leaked memory.

Recommendations For SAP HANA versions 1.00 through 2.00, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2018-2369

Affected Products

Sap Hana

References · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2369 · Security Note
• http://securityfocus.com/bid/102997 · Note
• https://launchpad.support.sap.com/#/notes/2572940 · Note