CVE-2018-2362

A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/102452	Third Party Advisory VDB Entry
https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/	Vendor Advisory
https://launchpad.support.sap.com/#/notes/2575750	Permissions Required
http://www.securityfocus.com/bid/102452	Third Party Advisory VDB Entry
https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/	Vendor Advisory
https://launchpad.support.sap.com/#/notes/2575750	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:hana:1.00:::::::*
	cpe:2.3:a:sap:hana:2.00:::::::*

History

No history.

Information

Published : 2018-01-09 15:29

Updated : 2024-11-21 04:03

NVD link : CVE-2018-2362

Mitre link : CVE-2018-2362

CVE.ORG link : CVE-2018-2362

JSON object : View

Products Affected

sap

hana

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-2362", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-01-09T15:29:00.307", "references": [{"url": "http://www.securityfocus.com/bid/102452", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@sap.com"}, {"url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2575750", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "http://www.securityfocus.com/bid/102452", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://launchpad.support.sap.com/#/notes/2575750", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname."}, {"lang": "es", "value": "Un atacante remoto no autenticado en SAP HANA 1.00 y 2.00 podr\u00eda enviar peticiones SOAP especialmente manipuladas a SAP Startup Service y revelar informaci\u00f3n como el nombre del host de la plataforma."}], "lastModified": "2024-11-21T04:03:40.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:hana:1.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F2FF19E-60E0-43D1-81BA-282D4CD8517E"}, {"criteria": "cpe:2.3:a:sap:hana:2.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA82740E-3E8C-41DE-BC32-3099900C4F0A"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}