Vulnerability Description
In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Hana | 1.00 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/103369Third Party AdvisoryVDB Entry
- https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2587369Permissions RequiredVendor Advisory
- http://www.securityfocus.com/bid/103369Third Party AdvisoryVDB Entry
- https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2587369Permissions RequiredVendor Advisory
FAQ
What is CVE-2018-2402?
CVE-2018-2402 is a vulnerability with a CVSS score of 7.6 (HIGH). In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear tex...
How severe is CVE-2018-2402?
CVE-2018-2402 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-2402?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Hana.