PT-2018-15506 · Sap · Sap Hana Extended Application Services

Published 2018-02-14 · Updated 2023-12-21 · CVE-2018-2373

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services version 1.0

Description The issue allows unauthenticated users to misuse a specific endpoint of the Controller's API to execute SQL statements, potentially delivering information about system configuration.

Recommendations For SAP HANA Extended Application Services version 1.0, consider restricting access to the vulnerable API endpoint until a patch is available. As a temporary workaround, avoid using the endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2018-2373

Affected Products

Sap Hana Extended Application Services

References · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2373 · Security Note
• https://t.me/cvenotify/64604 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2589129 · Note