CVE-2018-2497: Medium severity sap hana database vulnerability
The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <tablename> AS SELECT.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2018-2497.
What is the severity of CVE-2018-2497?
CVE-2018-2497 has a severity value of 2.7, which is considered medium.
Which versions of SAP HANA are affected by CVE-2018-2497?
CVE-2018-2497 affects SAP HANA versions 1.0 and 2.0.
What events are not logged in the security audit log due to CVE-2018-2497?
CVE-2018-2497 prevents the logging of SELECT events that are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.
Where can I find more information about CVE-2018-2497?
More information about CVE-2018-2497 can be found at the following references: [SecurityFocus](http://www.securityfocus.com/bid/106152), [SAP Support](https://launchpad.support.sap.com/#/notes/2704878), and [SAP SCN Wiki](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699).