CVE-2018-2373

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP HANA Extended Application Services, 1.0.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
SAP SE	SAP HANA Extended Application Services	1.0

References

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2589129Permissions Required
https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2589129Permissions Required

Timeline

Published: Feb 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-23746.5In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sens CVE-2018-23758.1In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve appl CVE-2018-23768.1In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve appl CVE-2018-23776.5In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized use CVE-2018-23786.5In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource CVE-2018-23796.5In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages CVE-2018-23806.6SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu CVE-2018-23818.8SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, CVE-2018-23826.5A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a co CVE-2018-23836.1Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.CVE-2018-23846.5Under certain conditions a malicious user provoking a Null Pointer dereference can prevent legitimate users from accessing the SAP Internet CVE-2018-23856.5Under certain conditions a malicious user provoking a divide by zero crash can prevent legitimate users from accessing the SAP Internet Grap