CVE-2018-2373

{"id": "CVE-2018-2373", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-02-14T12:29:00.483", "references": [{"url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2589129", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://launchpad.support.sap.com/#/notes/2589129", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP HANA Extended Application Services, 1.0."}, {"lang": "es", "value": "Bajo ciertas circunstancias, un endpoint espec\u00edfico de la API del controlador podr\u00eda ser empleado err\u00f3neamente por usuarios no autenticados para ejecutar instrucciones SQL que env\u00edan informaci\u00f3n sobre la configuraci\u00f3n del sistema en SAP HANA Extended Application Services 1.0."}], "lastModified": "2024-11-21T04:03:42.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:hana_extended_application_services:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F314AEB2-7F5C-4CD8-8DD5-359B75FCD9C5"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}