PT-2018-15507 · Sap · Sap Hana Extended Application Services

Published 2018-02-14 · Updated 2023-12-21 · CVE-2018-2374

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services version 1.0

Description A controller user with SpaceAuditor authorization in a specific space could retrieve sensitive application data, such as service bindings, within that space.

Recommendations For SAP HANA Extended Application Services version 1.0, restrict access to the SpaceAuditor authorization to minimize the risk of sensitive data retrieval.

Fix

Related Identifiers

CVE-2018-2374

Affected Products

Sap Hana Extended Application Services

References · 6

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2374 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2374 · Vendor Advisory
• https://t.me/cvenotify/64605 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2589129 · Note
• http://securityfocus.com/bid/103018 · Note