Lucene search

[email protected]CVE-2018-2362

HistoryJan 09, 2018 - 3:29 p.m.

CVE-2018-2362

2018-01-0915:29:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2018-2362

sap hana

remote attack

soap requests

information disclosure

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

7 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

58.0%

JSON

A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform’s hostname.

CPENameOperatorVersion
sap:hanasap hanaeq2.00
sap:hanasap hanaeq1.00

CPE	Name	Operator	Version
sap:hana	sap hana	eq	2.00
sap:hana	sap hana	eq	1.00

References

www.securityfocus.com/bid/102452

blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/

launchpad.support.sap.com/#/notes/2575750

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

7 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

58.0%

JSON

Related for CVE-2018-2362

prion1 cvelist1