CVE-2018-2402: Infoleak
In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability identified as CVE-2018-2402?
The vulnerability identified as CVE-2018-2402 is related to the optional capture & replay functionality of SAP HANA 1.00 and 2.00.
How can an attacker exploit the vulnerability?
An attacker with the required authorizations can access and retrieve user credentials stored in clear text in the indexserver trace files of the control system.
Which versions of SAP HANA are affected by CVE-2018-2402?
SAP HANA 1.00 and 2.00 versions are affected by CVE-2018-2402.
What is the severity rating of CVE-2018-2402?
CVE-2018-2402 has a severity rating of 8.4 (high).
Are there any references for more information about CVE-2018-2402?
Yes, you can refer to the following links for more information: http://www.securityfocus.com/bid/103369, https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/, https://launchpad.support.sap.com/#/notes/2587369