Lucene search

[email protected]CVE-2018-2497

HistoryDec 11, 2018 - 10:29 p.m.

CVE-2018-2497

2018-12-1122:29:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

sap hana

security audit log

cve-2018-2497

nvd

select events

create table

version 1.0

version 2.0

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

7.1 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

30.8%

JSON

The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.

CPENameOperatorVersion
sap:hanasap hanaeq2.0
sap:hanasap hanaeq1.0

CPE	Name	Operator	Version
sap:hana	sap hana	eq	2.0
sap:hana	sap hana	eq	1.0

References

www.securityfocus.com/bid/106152

launchpad.support.sap.com/#/notes/2704878

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

7.1 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

30.8%

JSON

Related for CVE-2018-2497

prion1 cvelist1