PT-2018-15505 · Sap · Sap Hana Extended Application Services

Published 2018-02-14 · Updated 2023-12-21 · CVE-2018-2372

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services version 1.0

Description A plain keystore password is written to a system log file, which could endanger the confidentiality of SSL communication.

Recommendations For SAP HANA Extended Application Services version 1.0, consider restricting access to system log files to minimize the risk of exploitation. As a temporary workaround, review and securely configure logging settings to prevent sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-2372

Affected Products

Sap Hana Extended Application Services

References · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2372 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2372 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2589129 · Note
• https://t.me/cvenotify/64603 · Telegram Post