CVE-2018-2451: Medium severity sap hana extended application services, advanced model vulnerability
XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolonged period of validity. Consequently, a platform user could access controller resources via active CLI session even after corresponding authorizations have been revoked meanwhile by an administrator user. Similarly, an attacker who managed to gain access to the platform user's session might misuse the session token even after the session has been closed.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-2451?
CVE-2018-2451 is classified as a medium severity vulnerability due to its potential for unauthorized access to user sessions.
How do I fix CVE-2018-2451?
To fix CVE-2018-2451, ensure that the user sessions in SAP HANA Extended Application Services are configured to expire appropriately.
Who is affected by CVE-2018-2451?
CVE-2018-2451 affects users of SAP HANA Extended Application Services version 1.0 who utilize the CLI.
What type of vulnerability is CVE-2018-2451?
CVE-2018-2451 is a session management vulnerability that can lead to unauthorized access if session validity is not correctly managed.
What impact does CVE-2018-2451 have on users?
CVE-2018-2451 allows a platform user to access protected controller resources through an active CLI session for longer than intended.