CVE-2018-2369

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the SAP HANA server on its SQL interface and disclose 8 bytes of the server process memory. The attacker cannot influence or predict the location of the leaked memory.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-23705.3Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, fr CVE-2018-23716.1The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which res CVE-2018-23726.5A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiali CVE-2018-23737.5Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements CVE-2018-23746.5In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sens CVE-2018-23758.1In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve appl CVE-2018-23768.1In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve appl CVE-2018-23776.5In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized use CVE-2018-23786.5In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource CVE-2018-23796.5In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages CVE-2018-23806.6SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu CVE-2018-23818.8SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00,