CVE-2018-2402

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.

Metrics

CVSS 3.0 8.4/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
SAP SE	SAP HANA	1.0; 2.0

References

http://www.securityfocus.com/bid/103369Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2587369Permissions Required, Vendor Advisory
http://www.securityfocus.com/bid/103369Third Party Advisory, VDB Entry
https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2587369Permissions Required, Vendor Advisory

Timeline

Published: Mar 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24036.5Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is CVE-2018-24049.8SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.CVE-2018-24055.4SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this CVE-2018-24065.3Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, CVE-2018-24087.3Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of pa CVE-2018-24098.8Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of CVE-2018-24105.4SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS CVE-2018-24128.8SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile CVE-2018-24138.8SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile CVE-2018-24154.7SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Ser CVE-2018-24165.4SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.CVE-2018-24175.3Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherw