Vulnerability Details : CVE-2018-2369
Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the SAP HANA server on its SQL interface and disclose 8 bytes of the server process memory. The attacker cannot influence or predict the location of the leaked memory.
Products affected by CVE-2018-2369
- cpe:2.3:a:sap:hana:1.00:*:*:*:*:*:*:*
- cpe:2.3:a:sap:hana:2.00:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-2369
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-2369
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2018-2369
-
https://launchpad.support.sap.com/#/notes/2572940
SAP ONE Support Launchpad: Log OnPermissions Required
-
http://www.securityfocus.com/bid/102997
SAP HANA CVE-2018-2369 Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
SAP Security Patch Day – February 2018 | SAP BlogsVendor Advisory
Jump to