cnvd - cnvd-2022-56946

CNVD-2022-56946

Vulnerability from cnvd - Published: 2022-08-15

Title

SAP Enterprise Extension Defense Forces&Public Security授权问题漏洞

Description

SAP Enterprise Extension Defense Forces＆Public Security是德国SAP公司的一种军事解决方案。用于国防军和公共安全。 SAP Enterprise Extension Defense Forces＆Public Security存在授权问题漏洞，该漏洞源于其在网络上对经过身份验证的用户未执行必要的授权检查，攻击者可利用该漏洞导致特权升级。

Severity

中

Patch Name

SAP Enterprise Extension Defense Forces&Public Security授权问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://launchpad.support.sap.com/#/notes/3196280

Reference

https://launchpad.support.sap.com/#/notes/3196280

Impacted products

Name
['SAP Enterprise Extension Defense Forces & Public Security 605', 'SAP Enterprise Extension Defense Forces & Public Security 606', 'SAP Enterprise Extension Defense Forces & Public Security 616', 'SAP Enterprise Extension Defense Forces & Public Security 617', 'SAP Enterprise Extension Defense Forces & Public Security 618', 'SAP Enterprise Extension Defense Forces & Public Security 802', 'SAP Enterprise Extension Defense Forces & Public Security 803', 'SAP Enterprise Extension Defense Forces & Public Security 804', 'SAP Enterprise Extension Defense Forces & Public Security 805', 'SAP Enterprise Extension Defense Forces & Public Security 806']

Name

['SAP Enterprise Extension Defense Forces & Public Security 605', 'SAP Enterprise Extension Defense Forces & Public Security 606', 'SAP Enterprise Extension Defense Forces & Public Security 616', 'SAP Enterprise Extension Defense Forces & Public Security 617', 'SAP Enterprise Extension Defense Forces & Public Security 618', 'SAP Enterprise Extension Defense Forces & Public Security 802', 'SAP Enterprise Extension Defense Forces & Public Security 803', 'SAP Enterprise Extension Defense Forces & Public Security 804', 'SAP Enterprise Extension Defense Forces & Public Security 805', 'SAP Enterprise Extension Defense Forces & Public Security 806']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-31592",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-31592"
    }
  },
  "description": "SAP Enterprise Extension Defense Forces\uff06Public Security\u662f\u5fb7\u56fdSAP\u516c\u53f8\u7684\u4e00\u79cd\u519b\u4e8b\u89e3\u51b3\u65b9\u6848\u3002\u7528\u4e8e\u56fd\u9632\u519b\u548c\u516c\u5171\u5b89\u5168\u3002\n\nSAP Enterprise Extension Defense Forces\uff06Public Security\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5176\u5728\u7f51\u7edc\u4e0a\u5bf9\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u672a\u6267\u884c\u5fc5\u8981\u7684\u6388\u6743\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7279\u6743\u5347\u7ea7\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://launchpad.support.sap.com/#/notes/3196280",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-56946",
  "openTime": "2022-08-15",
  "patchDescription": "SAP Enterprise Extension Defense Forces\uff06Public Security\u662f\u5fb7\u56fdSAP\u516c\u53f8\u7684\u4e00\u79cd\u519b\u4e8b\u89e3\u51b3\u65b9\u6848\u3002\u7528\u4e8e\u56fd\u9632\u519b\u548c\u516c\u5171\u5b89\u5168\u3002\r\n\r\nSAP Enterprise Extension Defense Forces\uff06Public Security\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5176\u5728\u7f51\u7edc\u4e0a\u5bf9\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u672a\u6267\u884c\u5fc5\u8981\u7684\u6388\u6743\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7279\u6743\u5347\u7ea7\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Enterprise Extension Defense Forces\u0026Public Security\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 605",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 606",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 616",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 617",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 618",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 802",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 803",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 804",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 805",
      "SAP Enterprise Extension Defense Forces \u0026 Public Security 806"
    ]
  },
  "referenceLink": "https://launchpad.support.sap.com/#/notes/3196280",
  "serverity": "\u4e2d",
  "submitTime": "2022-07-15",
  "title": "SAP Enterprise Extension Defense Forces\u0026Public Security\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2022-31592 (GCVE-0-2022-31592)

Vulnerability from cvelistv5 – Published: 2022-07-12 20:26 – Updated: 2024-08-03 07:19

Summary

The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality.

Severity ?

No CVSS data available.

CWE

CWE-862

Assigner

sap

References

URL

Tags

	https://www.sap.com/documents/2022/02/fa865ea4-16…	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3196280	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAP SE	SAP Enterprise Extension Defense Forces & Public Security (EA-DFPS)	Affected: 605 Affected: 606 Affected: 616 Affected: 617 Affected: 618 Affected: 802 Affected: 803 Affected: 804 Affected: 805 Affected: 806

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:19:06.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3196280"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Enterprise Extension Defense Forces \u0026 Public Security (EA-DFPS)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "616"
            },
            {
              "status": "affected",
              "version": "617"
            },
            {
              "status": "affected",
              "version": "618"
            },
            {
              "status": "affected",
              "version": "802"
            },
            {
              "status": "affected",
              "version": "803"
            },
            {
              "status": "affected",
              "version": "804"
            },
            {
              "status": "affected",
              "version": "805"
            },
            {
              "status": "affected",
              "version": "806"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The application SAP Enterprise Extension Defense Forces \u0026 Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-12T20:26:34",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3196280"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-31592",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Enterprise Extension Defense Forces \u0026 Public Security (EA-DFPS)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "605"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "606"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "616"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "617"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "618"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "802"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "803"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "804"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "805"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "806"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The application SAP Enterprise Extension Defense Forces \u0026 Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3196280",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3196280"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-31592",
    "datePublished": "2022-07-12T20:26:34",
    "dateReserved": "2022-05-24T00:00:00",
    "dateUpdated": "2024-08-03T07:19:06.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-56946

CVE-2022-31592 (GCVE-0-2022-31592)

Tags

Sightings

Nomenclature