CVE-2018-2402

HIGH

SAP HANA 1.00 and 2.00 - Unauthorized Exposure of User Credentials in Indexserver Trace Files

Title source: llm
STIX 2.1

Description

In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/103369
Permissions Required, Vendor Advisory x_refsource_confirm
https://launchpad.support.sap.com/#/notes/2587369

Scores

CVSS v3 7.6
EPSS 0.0027
EPSS Percentile 50.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-200
Status published
Products (2)
sap/hana 1.00
sap/hana 2.00
Published Mar 14, 2018
Tracked Since Feb 18, 2026