CVE-2018-2373

HIGH

SAP HANA Extended Application Services 1.0 - Unauthenticated SQL Injection via Controller API Endpoint

Title source: llm
STIX 2.1

Description

Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP HANA Extended Application Services, 1.0.

References (2)

Core 2
Core References
Permissions Required x_refsource_confirm
https://launchpad.support.sap.com/#/notes/2589129

Scores

CVSS v3 7.5
EPSS 0.0077
EPSS Percentile 73.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Status published
Products (1)
sap/hana_extended_application_services 1.0
Published Feb 14, 2018
Tracked Since Feb 18, 2026