Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-28214 (GCVE-0-2022-28214)
Vulnerability from cvelistv5 – Published: 2022-05-11 14:54 – Updated: 2024-08-03 05:48
VLAI?
EPSS
Summary
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SAP SE | SAP BusinessObjects Enterprise (Central Management Server) |
Affected:
420
Affected: 430 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:48:37.497Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2998510"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP BusinessObjects Enterprise (Central Management Server)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "420"
},
{
"status": "affected",
"version": "430"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-11T14:54:42",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2998510"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2022-28214",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP BusinessObjects Enterprise (Central Management Server)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "420"
},
{
"version_affected": "=",
"version_value": "430"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability."
}
]
},
"impact": {
"cvss": {
"baseScore": "null",
"vectorString": "null",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-312"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"refsource": "MISC",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"name": "https://launchpad.support.sap.com/#/notes/2998510",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2998510"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2022-28214",
"datePublished": "2022-05-11T14:54:42",
"dateReserved": "2022-03-30T00:00:00",
"dateUpdated": "2024-08-03T05:48:37.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:businessobjects:420:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"402CA360-5CBB-41FD-95E5-239C3DBC3BAD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:businessobjects:430:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"85CA5F35-E406-4691-BDA9-6D467F44CE4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38BA0DF9-D893-4AF9-923E-E47EA5C02C52\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"85CBCF48-5478-4EE5-8F69-6E59EFDB707D\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\\u2019 Confidentiality, Integrity, and Availability.\"}, {\"lang\": \"es\", \"value\": \"Durante una actualizaci\\u00f3n de SAP BusinessObjects Enterprise, Central Management Server (CMS) - versiones 420, 430, las credenciales de autenticaci\\u00f3n est\\u00e1n siendo expuestas en los registros de eventos de Sysmon. Esta divulgaci\\u00f3n de informaci\\u00f3n podr\\u00eda causar un alto impacto en la confidencialidad, integridad y disponibilidad de los sistemas\"}]",
"id": "CVE-2022-28214",
"lastModified": "2024-11-21T06:56:57.753",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2022-05-11T15:15:09.730",
"references": "[{\"url\": \"https://launchpad.support.sap.com/#/notes/2998510\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2998510\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"cna@sap.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-312\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-28214\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2022-05-11T15:15:09.730\",\"lastModified\":\"2024-11-21T06:56:57.753\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability.\"},{\"lang\":\"es\",\"value\":\"Durante una actualizaci\u00f3n de SAP BusinessObjects Enterprise, Central Management Server (CMS) - versiones 420, 430, las credenciales de autenticaci\u00f3n est\u00e1n siendo expuestas en los registros de eventos de Sysmon. Esta divulgaci\u00f3n de informaci\u00f3n podr\u00eda causar un alto impacto en la confidencialidad, integridad y disponibilidad de los sistemas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-312\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:businessobjects:420:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"402CA360-5CBB-41FD-95E5-239C3DBC3BAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:businessobjects:430:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"85CA5F35-E406-4691-BDA9-6D467F44CE4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38BA0DF9-D893-4AF9-923E-E47EA5C02C52\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85CBCF48-5478-4EE5-8F69-6E59EFDB707D\"}]}]}],\"references\":[{\"url\":\"https://launchpad.support.sap.com/#/notes/2998510\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2998510\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
CERTFR-2022-AVI-456
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Customer Profitability Analytics version 2 | ||
| SAP | N/A | SAP Netweaver AS for ABAP and Java (ICM) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, 8.04, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 8.04 | ||
| SAP | N/A | SAP NetWeaver Application Server ABAP versions 753, 754, 755 et 756 | ||
| SAP | N/A | SAP Business One Cloud version 1.1 | ||
| SAP | N/A | SAP NetWeaver and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 7.8 | ||
| SAP | N/A | SAP Webdispatcher versions 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.83 et 7.85 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005, 2105 et 2011 | ||
| SAP | N/A | SAP Employee Self Service (Fiori My Leave Request) version 605 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750 et 787 | ||
| SAP | N/A | SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 et 788 | ||
| SAP | N/A | SAP NetWeaver (ABAP and Java application Servers) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 756 | ||
| SAP | N/A | SAP Host Agent version 7.22 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Customer Profitability Analytics version 2",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Netweaver AS for ABAP and Java (ICM) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, 8.04, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 8.04",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP versions 753, 754, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One Cloud version 1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 7.8",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Webdispatcher versions 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.83 et 7.85",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005, 2105 et 2011",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Employee Self Service (Fiori My Leave Request) version 605",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750 et 787",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 et 788",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (ABAP and Java application Servers) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Host Agent version 7.22",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-22965",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
},
{
"name": "CVE-2022-29610",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29610"
},
{
"name": "CVE-2022-28214",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28214"
},
{
"name": "CVE-2022-22541",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22541"
},
{
"name": "CVE-2022-29616",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29616"
},
{
"name": "CVE-2022-28774",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28774"
},
{
"name": "CVE-2022-28215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28215"
},
{
"name": "CVE-2022-29613",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29613"
},
{
"name": "CVE-2022-29611",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29611"
},
{
"name": "CVE-2022-27656",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27656"
},
{
"name": "CVE-2022-22534",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22534"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-456",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-05-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 10 mai 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=10"
}
]
}
CERTFR-2022-AVI-345
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver Application Server pour ABAP | SAP NetWeaver Application Server pour ABAP (Kernel) et ABAP Platform (Kernel) versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions 700, 710, 711, 730, 731, 740 et 750-756 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.22, 7.49, 7.53, 7.77, 7.81 et 7.83 | ||
| SAP | N/A | SAPS/4HANA(Supplier Factsheet et Enterprise Search pour Business Partner, Supplier et Customer) versions 104, 105 et 106 | ||
| SAP | N/A | SAP Content Server version 7.53 | ||
| SAP | N/A | SAP SQL Anywhere Server version 17.0 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86 et 7.87 | ||
| SAP | N/A | SAPUI5, versions 750, 753, 754, 755, 756 et 200 | ||
| SAP | N/A | SAP Manufacturing Integration et Intelligence versions 15.1, 15.2, 15.3 et 15.4 | ||
| SAP | N/A | SAP Powerdesigner Web Portal version 16.7 | ||
| SAP | N/A | SAP Customer Checkout_SVR version 2.0 | ||
| SAP | N/A | SAP NetWeaver (Internet Communication Manager versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86 | ||
| SAP | N/A | SAP Business Client version 6.5 | ||
| SAP | N/A | SAP NetWeaver Application Server pour Java Version 7.50 | ||
| SAP | N/A | SAP Customer Checkout version 2.0 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP Focused Run (Simple Diagnostics Agent) version 1.0 | ||
| SAP | N/A | SAP 3D Visual Enterprise Viewer version 9 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50 | ||
| SAP | N/A | SAP Fiori Launchpad versions 54, 755 et 756 | ||
| SAP | N/A | SAP NetWeaver (EP Web Page Composer) versions 7.20, 7.30, 7.31, 7.40 et 7.50 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.53, 7.77, 7.81, 7.85 et 7.86 | ||
| SAP | N/A | SAP Commerce versions 905, 2005, 2105 et 2011 | ||
| SAP | N/A | SAP Innovation Management version 2 | ||
| SAP | N/A | SAP BusinessObjects Enterprise (Central Management Server) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (BI Workspace) version 420 | ||
| SAP | NetWeaver et ABAP | SAP NetWeaver et ABAP Platform versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49 | ||
| SAP | N/A | SAPUI5 (vbm library) versions 750, 753, 754, 755 et 756 | ||
| SAP | N/A | SAP NetWeaver Application Server Java versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49 et 7.53 | ||
| SAP | N/A | SAP NetWeaver (Internet Communication Manager) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86 | ||
| SAP | N/A | SAP HANA Extended Application Services version 1 | ||
| SAP | N/A | SAP NetWeaver ABAP Server et ABAP Platform versions 740, 750 et 787 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP NetWeaver Application Server pour ABAP (Kernel) et ABAP Platform (Kernel) versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions 700, 710, 711, 730, 731, 740 et 750-756",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.22, 7.49, 7.53, 7.77, 7.81 et 7.83",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPS/4HANA(Supplier Factsheet et Enterprise Search pour Business Partner, Supplier et Customer) versions 104, 105 et 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Content Server version 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SQL Anywhere Server version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86 et 7.87",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5, versions 750, 753, 754, 755, 756 et 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Manufacturing Integration et Intelligence versions 15.1, 15.2, 15.3 et 15.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Powerdesigner Web Portal version 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Customer Checkout_SVR version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Internet Communication Manager versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client version 6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server pour Java Version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Customer Checkout version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Focused Run (Simple Diagnostics Agent) version 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP 3D Visual Enterprise Viewer version 9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori Launchpad versions 54, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (EP Web Page Composer) versions 7.20, 7.30, 7.31, 7.40 et 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.53, 7.77, 7.81, 7.85 et 7.86",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 905, 2005, 2105 et 2011",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Innovation Management version 2",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Enterprise (Central Management Server) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (BI Workspace) version 420",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver et ABAP Platform versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 (vbm library) versions 750, 753, 754, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server Java versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49 et 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Internet Communication Manager) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP HANA Extended Application Services version 1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server et ABAP Platform versions 740, 750 et 787",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-22965",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
},
{
"name": "CVE-2022-27654",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27654"
},
{
"name": "CVE-2022-22545",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22545"
},
{
"name": "CVE-2022-0613",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0613"
},
{
"name": "CVE-2022-26106",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26106"
},
{
"name": "CVE-2022-22543",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22543"
},
{
"name": "CVE-2022-28772",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28772"
},
{
"name": "CVE-2022-22536",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22536"
},
{
"name": "CVE-2022-23181",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23181"
},
{
"name": "CVE-2022-26107",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26107"
},
{
"name": "CVE-2022-28214",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28214"
},
{
"name": "CVE-2022-27667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27667"
},
{
"name": "CVE-2022-28216",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28216"
},
{
"name": "CVE-2022-28217",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28217"
},
{
"name": "CVE-2022-22541",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22541"
},
{
"name": "CVE-2022-27657",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27657"
},
{
"name": "CVE-2022-27671",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27671"
},
{
"name": "CVE-2022-26105",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26105"
},
{
"name": "CVE-2022-28770",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28770"
},
{
"name": "CVE-2022-27658",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27658"
},
{
"name": "CVE-2022-28773",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28773"
},
{
"name": "CVE-2022-22532",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22532"
},
{
"name": "CVE-2022-26101",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26101"
},
{
"name": "CVE-2021-21480",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21480"
},
{
"name": "CVE-2022-28213",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28213"
},
{
"name": "CVE-2022-28215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28215"
},
{
"name": "CVE-2022-27655",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27655"
},
{
"name": "CVE-2022-26109",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26109"
},
{
"name": "CVE-2022-27670",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27670"
},
{
"name": "CVE-2021-38162",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38162"
},
{
"name": "CVE-2020-26291",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26291"
},
{
"name": "CVE-2022-26108",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26108"
},
{
"name": "CVE-2021-27516",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27516"
},
{
"name": "CVE-2021-44832",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
},
{
"name": "CVE-2022-22533",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22533"
},
{
"name": "CVE-2021-3647",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3647"
},
{
"name": "CVE-2022-27669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27669"
},
{
"name": "CVE-2022-22542",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22542"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-345",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 12 avril 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=10"
}
]
}
CERTFR-2022-AVI-819
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420, 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (CMC) versions 430 | ||
| SAP | N/A | SAP Access Control version 12 | ||
| SAP | N/A | SAP Knowledge Warehouse versions 7.30, 7.31, 7.40, 7.50 | ||
| SAP | N/A | SAP NetWeaverASABAP versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.89, 7.54 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal (KMC) version 7.50 | ||
| SAP | N/A | SAP SuccessFactors attachment API for Mobile Application(Android &iOS) versions antérieures à 8.0.5 | ||
| SAP | N/A | SAP Business One version 10.0 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420, 430 | ||
| SAP | N/A | SAP NetWeaverASABAP (SAPGUIfor HTML within the Fiori Launchpad) versions KERNEL 7.77, 7.81, 7.85, 7.89, 7.54 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0, 7.70 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750-756, 787 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (CMC) versions 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Access Control version 12",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Knowledge Warehouse versions 7.30, 7.31, 7.40, 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaverASABAP versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.89, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal (KMC) version 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SuccessFactors attachment API for Mobile Application(Android \u0026iOS) versions ant\u00e9rieures \u00e0 8.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaverASABAP (SAPGUIfor HTML within the Fiori Launchpad) versions KERNEL 7.77, 7.81, 7.85, 7.89, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0, 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750-756, 787",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-35294",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35294"
},
{
"name": "CVE-2021-42063",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42063"
},
{
"name": "CVE-2022-35291",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35291"
},
{
"name": "CVE-2022-39801",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39801"
},
{
"name": "CVE-2022-28214",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28214"
},
{
"name": "CVE-2022-28215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28215"
},
{
"name": "CVE-2022-39014",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39014"
},
{
"name": "CVE-2022-35292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35292"
},
{
"name": "CVE-2022-35298",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35298"
},
{
"name": "CVE-2022-39799",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39799"
},
{
"name": "CVE-2022-35295",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35295"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-819",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-09-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 13 septembre 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026todaysdate=2022-09-14"
}
]
}
CERTFR-2022-AVI-456
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Customer Profitability Analytics version 2 | ||
| SAP | N/A | SAP Netweaver AS for ABAP and Java (ICM) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, 8.04, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 8.04 | ||
| SAP | N/A | SAP NetWeaver Application Server ABAP versions 753, 754, 755 et 756 | ||
| SAP | N/A | SAP Business One Cloud version 1.1 | ||
| SAP | N/A | SAP NetWeaver and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 7.8 | ||
| SAP | N/A | SAP Webdispatcher versions 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.83 et 7.85 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005, 2105 et 2011 | ||
| SAP | N/A | SAP Employee Self Service (Fiori My Leave Request) version 605 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750 et 787 | ||
| SAP | N/A | SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 et 788 | ||
| SAP | N/A | SAP NetWeaver (ABAP and Java application Servers) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 756 | ||
| SAP | N/A | SAP Host Agent version 7.22 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Customer Profitability Analytics version 2",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Netweaver AS for ABAP and Java (ICM) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, 8.04, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 8.04",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP versions 753, 754, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One Cloud version 1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 7.8",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Webdispatcher versions 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.83 et 7.85",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005, 2105 et 2011",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Employee Self Service (Fiori My Leave Request) version 605",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750 et 787",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 et 788",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (ABAP and Java application Servers) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Host Agent version 7.22",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-22965",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
},
{
"name": "CVE-2022-29610",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29610"
},
{
"name": "CVE-2022-28214",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28214"
},
{
"name": "CVE-2022-22541",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22541"
},
{
"name": "CVE-2022-29616",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29616"
},
{
"name": "CVE-2022-28774",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28774"
},
{
"name": "CVE-2022-28215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28215"
},
{
"name": "CVE-2022-29613",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29613"
},
{
"name": "CVE-2022-29611",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29611"
},
{
"name": "CVE-2022-27656",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27656"
},
{
"name": "CVE-2022-22534",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22534"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-456",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-05-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 10 mai 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=10"
}
]
}
CERTFR-2022-AVI-819
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420, 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (CMC) versions 430 | ||
| SAP | N/A | SAP Access Control version 12 | ||
| SAP | N/A | SAP Knowledge Warehouse versions 7.30, 7.31, 7.40, 7.50 | ||
| SAP | N/A | SAP NetWeaverASABAP versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.89, 7.54 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal (KMC) version 7.50 | ||
| SAP | N/A | SAP SuccessFactors attachment API for Mobile Application(Android &iOS) versions antérieures à 8.0.5 | ||
| SAP | N/A | SAP Business One version 10.0 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420, 430 | ||
| SAP | N/A | SAP NetWeaverASABAP (SAPGUIfor HTML within the Fiori Launchpad) versions KERNEL 7.77, 7.81, 7.85, 7.89, 7.54 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0, 7.70 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750-756, 787 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (CMC) versions 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Access Control version 12",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Knowledge Warehouse versions 7.30, 7.31, 7.40, 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaverASABAP versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.89, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal (KMC) version 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SuccessFactors attachment API for Mobile Application(Android \u0026iOS) versions ant\u00e9rieures \u00e0 8.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaverASABAP (SAPGUIfor HTML within the Fiori Launchpad) versions KERNEL 7.77, 7.81, 7.85, 7.89, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0, 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750-756, 787",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-35294",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35294"
},
{
"name": "CVE-2021-42063",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42063"
},
{
"name": "CVE-2022-35291",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35291"
},
{
"name": "CVE-2022-39801",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39801"
},
{
"name": "CVE-2022-28214",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28214"
},
{
"name": "CVE-2022-28215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28215"
},
{
"name": "CVE-2022-39014",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39014"
},
{
"name": "CVE-2022-35292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35292"
},
{
"name": "CVE-2022-35298",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35298"
},
{
"name": "CVE-2022-39799",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39799"
},
{
"name": "CVE-2022-35295",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35295"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-819",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-09-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 13 septembre 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026todaysdate=2022-09-14"
}
]
}
CERTFR-2022-AVI-345
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver Application Server pour ABAP | SAP NetWeaver Application Server pour ABAP (Kernel) et ABAP Platform (Kernel) versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions 700, 710, 711, 730, 731, 740 et 750-756 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.22, 7.49, 7.53, 7.77, 7.81 et 7.83 | ||
| SAP | N/A | SAPS/4HANA(Supplier Factsheet et Enterprise Search pour Business Partner, Supplier et Customer) versions 104, 105 et 106 | ||
| SAP | N/A | SAP Content Server version 7.53 | ||
| SAP | N/A | SAP SQL Anywhere Server version 17.0 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86 et 7.87 | ||
| SAP | N/A | SAPUI5, versions 750, 753, 754, 755, 756 et 200 | ||
| SAP | N/A | SAP Manufacturing Integration et Intelligence versions 15.1, 15.2, 15.3 et 15.4 | ||
| SAP | N/A | SAP Powerdesigner Web Portal version 16.7 | ||
| SAP | N/A | SAP Customer Checkout_SVR version 2.0 | ||
| SAP | N/A | SAP NetWeaver (Internet Communication Manager versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86 | ||
| SAP | N/A | SAP Business Client version 6.5 | ||
| SAP | N/A | SAP NetWeaver Application Server pour Java Version 7.50 | ||
| SAP | N/A | SAP Customer Checkout version 2.0 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP Focused Run (Simple Diagnostics Agent) version 1.0 | ||
| SAP | N/A | SAP 3D Visual Enterprise Viewer version 9 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50 | ||
| SAP | N/A | SAP Fiori Launchpad versions 54, 755 et 756 | ||
| SAP | N/A | SAP NetWeaver (EP Web Page Composer) versions 7.20, 7.30, 7.31, 7.40 et 7.50 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.53, 7.77, 7.81, 7.85 et 7.86 | ||
| SAP | N/A | SAP Commerce versions 905, 2005, 2105 et 2011 | ||
| SAP | N/A | SAP Innovation Management version 2 | ||
| SAP | N/A | SAP BusinessObjects Enterprise (Central Management Server) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (BI Workspace) version 420 | ||
| SAP | NetWeaver et ABAP | SAP NetWeaver et ABAP Platform versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49 | ||
| SAP | N/A | SAPUI5 (vbm library) versions 750, 753, 754, 755 et 756 | ||
| SAP | N/A | SAP NetWeaver Application Server Java versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49 et 7.53 | ||
| SAP | N/A | SAP NetWeaver (Internet Communication Manager) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86 | ||
| SAP | N/A | SAP HANA Extended Application Services version 1 | ||
| SAP | N/A | SAP NetWeaver ABAP Server et ABAP Platform versions 740, 750 et 787 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP NetWeaver Application Server pour ABAP (Kernel) et ABAP Platform (Kernel) versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions 700, 710, 711, 730, 731, 740 et 750-756",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.22, 7.49, 7.53, 7.77, 7.81 et 7.83",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPS/4HANA(Supplier Factsheet et Enterprise Search pour Business Partner, Supplier et Customer) versions 104, 105 et 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Content Server version 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SQL Anywhere Server version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86 et 7.87",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5, versions 750, 753, 754, 755, 756 et 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Manufacturing Integration et Intelligence versions 15.1, 15.2, 15.3 et 15.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Powerdesigner Web Portal version 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Customer Checkout_SVR version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Internet Communication Manager versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client version 6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server pour Java Version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Customer Checkout version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Focused Run (Simple Diagnostics Agent) version 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP 3D Visual Enterprise Viewer version 9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori Launchpad versions 54, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (EP Web Page Composer) versions 7.20, 7.30, 7.31, 7.40 et 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.53, 7.77, 7.81, 7.85 et 7.86",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 905, 2005, 2105 et 2011",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Innovation Management version 2",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Enterprise (Central Management Server) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (BI Workspace) version 420",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver et ABAP Platform versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT et 7.49",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 (vbm library) versions 750, 753, 754, 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server Java versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49 et 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Internet Communication Manager) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 et 7.86",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP HANA Extended Application Services version 1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server et ABAP Platform versions 740, 750 et 787",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-22965",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
},
{
"name": "CVE-2022-27654",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27654"
},
{
"name": "CVE-2022-22545",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22545"
},
{
"name": "CVE-2022-0613",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0613"
},
{
"name": "CVE-2022-26106",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26106"
},
{
"name": "CVE-2022-22543",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22543"
},
{
"name": "CVE-2022-28772",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28772"
},
{
"name": "CVE-2022-22536",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22536"
},
{
"name": "CVE-2022-23181",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23181"
},
{
"name": "CVE-2022-26107",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26107"
},
{
"name": "CVE-2022-28214",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28214"
},
{
"name": "CVE-2022-27667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27667"
},
{
"name": "CVE-2022-28216",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28216"
},
{
"name": "CVE-2022-28217",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28217"
},
{
"name": "CVE-2022-22541",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22541"
},
{
"name": "CVE-2022-27657",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27657"
},
{
"name": "CVE-2022-27671",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27671"
},
{
"name": "CVE-2022-26105",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26105"
},
{
"name": "CVE-2022-28770",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28770"
},
{
"name": "CVE-2022-27658",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27658"
},
{
"name": "CVE-2022-28773",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28773"
},
{
"name": "CVE-2022-22532",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22532"
},
{
"name": "CVE-2022-26101",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26101"
},
{
"name": "CVE-2021-21480",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21480"
},
{
"name": "CVE-2022-28213",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28213"
},
{
"name": "CVE-2022-28215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28215"
},
{
"name": "CVE-2022-27655",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27655"
},
{
"name": "CVE-2022-26109",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26109"
},
{
"name": "CVE-2022-27670",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27670"
},
{
"name": "CVE-2021-38162",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38162"
},
{
"name": "CVE-2020-26291",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26291"
},
{
"name": "CVE-2022-26108",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26108"
},
{
"name": "CVE-2021-27516",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27516"
},
{
"name": "CVE-2021-44832",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
},
{
"name": "CVE-2022-22533",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22533"
},
{
"name": "CVE-2021-3647",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3647"
},
{
"name": "CVE-2022-27669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27669"
},
{
"name": "CVE-2022-22542",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22542"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-345",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 12 avril 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=10"
}
]
}
GSD-2022-28214
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-28214",
"description": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability.",
"id": "GSD-2022-28214"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-28214"
],
"details": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability.",
"id": "GSD-2022-28214",
"modified": "2023-12-13T01:19:34.648124Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2022-28214",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP BusinessObjects Enterprise (Central Management Server)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "420"
},
{
"version_affected": "=",
"version_value": "430"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability."
}
]
},
"impact": {
"cvss": {
"baseScore": "null",
"vectorString": "null",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-312"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"refsource": "MISC",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"name": "https://launchpad.support.sap.com/#/notes/2998510",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2998510"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:businessobjects:430:*:*:*:enterprise:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:businessobjects:420:*:*:*:enterprise:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2022-28214"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://launchpad.support.sap.com/#/notes/2998510",
"refsource": "MISC",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/2998510"
},
{
"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-05-19T03:17Z",
"publishedDate": "2022-05-11T15:15Z"
}
}
}
GHSA-VFRH-2HH5-C79G
Vulnerability from github – Published: 2022-05-12 00:01 – Updated: 2022-05-20 00:00
VLAI?
Details
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.
Severity ?
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-28214"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-11T15:15:00Z",
"severity": "HIGH"
},
"details": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability.",
"id": "GHSA-vfrh-2hh5-c79g",
"modified": "2022-05-20T00:00:52Z",
"published": "2022-05-12T00:01:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28214"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2998510"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2022-28214
Vulnerability from fkie_nvd - Published: 2022-05-11 15:15 - Updated: 2024-11-21 06:56
Severity ?
Summary
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.
References
| URL | Tags | ||
|---|---|---|---|
| cna@sap.com | https://launchpad.support.sap.com/#/notes/2998510 | Permissions Required, Vendor Advisory | |
| cna@sap.com | https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://launchpad.support.sap.com/#/notes/2998510 | Permissions Required, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| sap | businessobjects | 420 | |
| sap | businessobjects | 430 | |
| sap | businessobjects_business_intelligence | 420 | |
| sap | businessobjects_business_intelligence | 430 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:businessobjects:420:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "402CA360-5CBB-41FD-95E5-239C3DBC3BAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:businessobjects:430:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "85CA5F35-E406-4691-BDA9-6D467F44CE4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*",
"matchCriteriaId": "38BA0DF9-D893-4AF9-923E-E47EA5C02C52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*",
"matchCriteriaId": "85CBCF48-5478-4EE5-8F69-6E59EFDB707D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems\u2019 Confidentiality, Integrity, and Availability."
},
{
"lang": "es",
"value": "Durante una actualizaci\u00f3n de SAP BusinessObjects Enterprise, Central Management Server (CMS) - versiones 420, 430, las credenciales de autenticaci\u00f3n est\u00e1n siendo expuestas en los registros de eventos de Sysmon. Esta divulgaci\u00f3n de informaci\u00f3n podr\u00eda causar un alto impacto en la confidencialidad, integridad y disponibilidad de los sistemas"
}
],
"id": "CVE-2022-28214",
"lastModified": "2024-11-21T06:56:57.753",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-11T15:15:09.730",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/2998510"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/2998510"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
],
"source": "cna@sap.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…