Low severity2.7NVD Advisory· Published Dec 11, 2018· Updated Jun 17, 2026

CVE-2018-2497

Description

The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.

Affected products

SAP/Hana4 versions
cpe:2.3:a:sap:hana:1.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:sap:hana:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:sap:hana:2.0:*:*:*:*:*:*:*
- (no CPE)range: 1.0, 2.0
- (no CPE)range: = 1.0

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/106152nvdThird Party AdvisoryVDB Entry
launchpad.support.sap.comnvdPermissions RequiredVendor Advisory
wiki.scn.sap.com/wiki/pages/viewpage.actionnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.176
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000