In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about c…

Published 8 y ago 2018-03-14 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.6

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.5%

percentile 74%

Public exploits

none known

In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.

Exploit prediction (EPSS)

1.49% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.6	`CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H`
CNA	3.0	7.6	`CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H`
NVD	3.0	8.4	`CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:P/I:N/A:N`

Affected products

SAP SE SAP HANA

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

blogs.sap.com /2018/03/13/sap-security-patch-day-march-2018/ · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/103369 · vdb-entry, x_refsource_BID, x_transferred
launchpad.support.sap.com /#/notes/2587369 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-2402
NVD: CVE-2018-2402

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.