Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-39013 (GCVE-0-2022-39013)
Vulnerability from cvelistv5 – Published: 2022-10-11 00:00 – Updated: 2024-08-03 11:10
VLAI?
EPSS
Summary
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SAP SE | SAP BusinessObjects Business Intelligence Platform (Program Objects) |
Affected:
420
Affected: 430 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T11:10:32.325Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/3229132"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP BusinessObjects Business Intelligence Platform (Program Objects)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "420"
},
{
"status": "affected",
"version": "430"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-14T00:00:00",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"url": "https://launchpad.support.sap.com/#/notes/3229132"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2022-39013",
"datePublished": "2022-10-11T00:00:00",
"dateReserved": "2022-08-29T00:00:00",
"dateUpdated": "2024-08-03T11:10:32.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_objects_business_intelligence_platform:420:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F7F8064-45BC-4A01-897A-0A2893BBBEC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.\"}, {\"lang\": \"es\", \"value\": \"Bajo determinadas condiciones, un atacante autenticado puede obtener acceso a las credenciales del Sistema Operativo. Obtener acceso a las credenciales del Sistema Operativo permite al atacante modificar los datos del sistema y hacer que el sistema no est\\u00e9 disponible, conllevando a un alto impacto en la Confidencialidad y un bajo impacto en la Integridad y disponibilidad de la aplicaci\\u00f3n\"}]",
"id": "CVE-2022-39013",
"lastModified": "2024-11-21T07:17:22.510",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\", \"baseScore\": 7.6, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.7}]}",
"published": "2022-10-11T21:15:13.943",
"references": "[{\"url\": \"https://launchpad.support.sap.com/#/notes/3229132\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/3229132\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"cna@sap.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-39013\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2022-10-11T21:15:13.943\",\"lastModified\":\"2024-11-21T07:17:22.510\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.\"},{\"lang\":\"es\",\"value\":\"Bajo determinadas condiciones, un atacante autenticado puede obtener acceso a las credenciales del Sistema Operativo. Obtener acceso a las credenciales del Sistema Operativo permite al atacante modificar los datos del sistema y hacer que el sistema no est\u00e9 disponible, conllevando a un alto impacto en la Confidencialidad y un bajo impacto en la Integridad y disponibilidad de la aplicaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_objects_business_intelligence_platform:420:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F7F8064-45BC-4A01-897A-0A2893BBBEC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3\"}]}]}],\"references\":[{\"url\":\"https://launchpad.support.sap.com/#/notes/3229132\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3229132\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
GSD-2022-39013
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-39013",
"description": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.",
"id": "GSD-2022-39013"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-39013"
],
"details": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.",
"id": "GSD-2022-39013",
"modified": "2023-12-13T01:19:20.823440Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2022-39013",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP BusinessObjects Business Intelligence Platform (Program Objects)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "420"
},
{
"version_affected": "=",
"version_value": "430"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application."
}
]
},
"impact": {
"cvss": {
"baseScore": "null",
"vectorString": "null",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"refsource": "MISC",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"name": "https://launchpad.support.sap.com/#/notes/3229132",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/3229132"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:420:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2022-39013"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://launchpad.support.sap.com/#/notes/3229132",
"refsource": "MISC",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/3229132"
},
{
"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7
}
},
"lastModifiedDate": "2023-07-21T20:09Z",
"publishedDate": "2022-10-11T21:15Z"
}
}
}
CERTFR-2022-AVI-1101
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Sourcing and SAP Contract Lifecycle Management version 1100 | ||
| SAP | N/A | SAP Business Objects Business Intelligence Platform (Web intelligence) versions 420, 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420, 430 | ||
| SAP | N/A | SAP Commerce Webservices 2.0 (Swagger UI) versions 1905, 2005, 2105, 2011, 2205 | ||
| SAP | N/A | SAP NetWeaver Process Integration version 7.50 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420, 430 | ||
| SAP | N/A | SAP NetWeaver AS pour Java (Http Provider Service) version 7.50 | ||
| SAP | N/A | SAP Solution Manager (Diagnostic Agent) version 7.20 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005, 2105, 2011, 2205 | ||
| SAP | N/A | SAP Solution Manager (Enterprise Search) versions 740, 750 | ||
| SAP | N/A | SAP Disclosure Management version 10.1 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0, 7.70 | ||
| SAP | N/A | SAP NetWeaver AS ABAP (Business ServerPages Test Application IT00) versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 | ||
| SAP | N/A | SAPUI5 versions 754, 755, 756, 757 | ||
| SAP | N/A | SAP Business Planning et Consolidation versions SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 8103229132 | ||
| SAP | N/A | SAPBASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789, 790 | ||
| SAP | N/A | SAPUI5 CLIENT RUNTIME versions 600, 700, 800, 900, 1000 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Sourcing and SAP Contract Lifecycle Management version 1100",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Objects Business Intelligence Platform (Web intelligence) versions 420, 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce Webservices 2.0 (Swagger UI) versions 1905, 2005, 2105, 2011, 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS pour Java (Http Provider Service) version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager (Diagnostic Agent) version 7.20",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005, 2105, 2011, 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager (Enterprise Search) versions 740, 750",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Disclosure Management version 10.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0, 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP (Business ServerPages Test Application IT00) versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions 754, 755, 756, 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Planning et Consolidation versions SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 8103229132",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPBASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789, 790",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 CLIENT RUNTIME versions 600, 700, 800, 900, 1000",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41266",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41266"
},
{
"name": "CVE-2022-41273",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41273"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2022-41263",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41263"
},
{
"name": "CVE-2022-41261",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41261"
},
{
"name": "CVE-2022-41264",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41264"
},
{
"name": "CVE-2022-42889",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42889"
},
{
"name": "CVE-2022-41268",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41268"
},
{
"name": "CVE-2022-41275",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41275"
},
{
"name": "CVE-2022-41271",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41271"
},
{
"name": "CVE-2020-6215",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-6215"
},
{
"name": "CVE-2022-39013",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39013"
},
{
"name": "CVE-2022-35737",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35737"
},
{
"name": "CVE-2022-41262",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41262"
},
{
"name": "CVE-2022-41215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41215"
},
{
"name": "CVE-2022-41274",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41274"
},
{
"name": "CVE-2022-41267",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41267"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-1101",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-12-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 13 d\u00e9cembre 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026todaysdate=2022-12-14"
}
]
}
CERTFR-2022-AVI-904
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Enable Now version 10 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420 et 430 | ||
| SAP | N/A | Product–SAP Commerce versions 1905, 2005, 2105, 2011, 2205 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005, 2105, 2011 et 2205 | ||
| SAP | N/A | SAP Data Services Management Console versions 4.2 et 4.3 | ||
| SAP | N/A | SAP SQL Anywhere version 17.0 | ||
| SAP | N/A | SAP Customer Data Cloud (Gigya) version 7.4 | ||
| SAP | N/A | SAP 3D Visual Enterprise Viewer version 9 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (BI LaunchPad) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform(Admin Tools/Query Builder) versions 420 et 430 | ||
| SAP | N/A | SAP Business Objects Platform (MonitoringDB) version 430 | ||
| SAP | N/A | SAP Manufacturing Execution versions 15.1, 15.2 et 15.3 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (CommentaryDB) versions 420 et 430 | ||
| SAP | N/A | SAP 3D Visual Enterprise Author version 9 | ||
| SAP | N/A | SAP IQ version 16.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Enable Now version 10",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product\u2013SAP Commerce versions 1905, 2005, 2105, 2011, 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005, 2105, 2011 et 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Data Services Management Console versions 4.2 et 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SQL Anywhere version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Customer Data Cloud (Gigya) version 7.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP 3D Visual Enterprise Viewer version 9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (BI LaunchPad) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform(Admin Tools/Query Builder) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Objects Platform (MonitoringDB) version 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Manufacturing Execution versions 15.1, 15.2 et 15.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (CommentaryDB) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP 3D Visual Enterprise Author version 9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP IQ version 16.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41185",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41185"
},
{
"name": "CVE-2022-41206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41206"
},
{
"name": "CVE-2022-39808",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39808"
},
{
"name": "CVE-2022-39803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39803"
},
{
"name": "CVE-2022-41175",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41175"
},
{
"name": "CVE-2022-41168",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41168"
},
{
"name": "CVE-2022-41193",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41193"
},
{
"name": "CVE-2022-41174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41174"
},
{
"name": "CVE-2022-41183",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41183"
},
{
"name": "CVE-2022-39807",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39807"
},
{
"name": "CVE-2022-41169",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41169"
},
{
"name": "CVE-2022-35296",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35296"
},
{
"name": "CVE-2022-35297",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35297"
},
{
"name": "CVE-2022-41197",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41197"
},
{
"name": "CVE-2022-41189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41189"
},
{
"name": "CVE-2022-41192",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41192"
},
{
"name": "CVE-2022-41180",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41180"
},
{
"name": "CVE-2022-41182",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41182"
},
{
"name": "CVE-2022-41167",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41167"
},
{
"name": "CVE-2022-41191",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41191"
},
{
"name": "CVE-2022-39805",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39805"
},
{
"name": "CVE-2022-41200",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41200"
},
{
"name": "CVE-2022-41210",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41210"
},
{
"name": "CVE-2022-39804",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39804"
},
{
"name": "CVE-2022-39800",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39800"
},
{
"name": "CVE-2021-41184",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41184"
},
{
"name": "CVE-2022-41178",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41178"
},
{
"name": "CVE-2022-41170",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41170"
},
{
"name": "CVE-2022-35226",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35226"
},
{
"name": "CVE-2022-41195",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41195"
},
{
"name": "CVE-2022-41201",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41201"
},
{
"name": "CVE-2022-32244",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32244"
},
{
"name": "CVE-2022-41209",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41209"
},
{
"name": "CVE-2022-41202",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41202"
},
{
"name": "CVE-2022-41172",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41172"
},
{
"name": "CVE-2022-41190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41190"
},
{
"name": "CVE-2022-41204",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41204"
},
{
"name": "CVE-2022-41171",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41171"
},
{
"name": "CVE-2022-41199",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41199"
},
{
"name": "CVE-2022-41176",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41176"
},
{
"name": "CVE-2022-41198",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41198"
},
{
"name": "CVE-2022-41181",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41181"
},
{
"name": "CVE-2022-41166",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41166"
},
{
"name": "CVE-2022-39013",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39013"
},
{
"name": "CVE-2022-41184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41184"
},
{
"name": "CVE-2022-35292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35292"
},
{
"name": "CVE-2022-39802",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39802"
},
{
"name": "CVE-2022-31596",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31596"
},
{
"name": "CVE-2022-39015",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39015"
},
{
"name": "CVE-2022-41196",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41196"
},
{
"name": "CVE-2022-41186",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41186"
},
{
"name": "CVE-2022-41187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41187"
},
{
"name": "CVE-2022-39806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39806"
},
{
"name": "CVE-2022-41177",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41177"
},
{
"name": "CVE-2022-41173",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41173"
},
{
"name": "CVE-2022-41188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41188"
},
{
"name": "CVE-2022-41179",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41179"
},
{
"name": "CVE-2022-41194",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41194"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-904",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-10-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 12 octobre 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2022-AVI-904
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Enable Now version 10 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420 et 430 | ||
| SAP | N/A | Product–SAP Commerce versions 1905, 2005, 2105, 2011, 2205 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005, 2105, 2011 et 2205 | ||
| SAP | N/A | SAP Data Services Management Console versions 4.2 et 4.3 | ||
| SAP | N/A | SAP SQL Anywhere version 17.0 | ||
| SAP | N/A | SAP Customer Data Cloud (Gigya) version 7.4 | ||
| SAP | N/A | SAP 3D Visual Enterprise Viewer version 9 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (BI LaunchPad) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420 et 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform(Admin Tools/Query Builder) versions 420 et 430 | ||
| SAP | N/A | SAP Business Objects Platform (MonitoringDB) version 430 | ||
| SAP | N/A | SAP Manufacturing Execution versions 15.1, 15.2 et 15.3 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (CommentaryDB) versions 420 et 430 | ||
| SAP | N/A | SAP 3D Visual Enterprise Author version 9 | ||
| SAP | N/A | SAP IQ version 16.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Enable Now version 10",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Version Management System) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product\u2013SAP Commerce versions 1905, 2005, 2105, 2011, 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005, 2105, 2011 et 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Data Services Management Console versions 4.2 et 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SQL Anywhere version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Customer Data Cloud (Gigya) version 7.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP 3D Visual Enterprise Viewer version 9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (BI LaunchPad) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform(Admin Tools/Query Builder) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Objects Platform (MonitoringDB) version 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Manufacturing Execution versions 15.1, 15.2 et 15.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (CommentaryDB) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP 3D Visual Enterprise Author version 9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP IQ version 16.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41185",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41185"
},
{
"name": "CVE-2022-41206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41206"
},
{
"name": "CVE-2022-39808",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39808"
},
{
"name": "CVE-2022-39803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39803"
},
{
"name": "CVE-2022-41175",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41175"
},
{
"name": "CVE-2022-41168",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41168"
},
{
"name": "CVE-2022-41193",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41193"
},
{
"name": "CVE-2022-41174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41174"
},
{
"name": "CVE-2022-41183",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41183"
},
{
"name": "CVE-2022-39807",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39807"
},
{
"name": "CVE-2022-41169",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41169"
},
{
"name": "CVE-2022-35296",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35296"
},
{
"name": "CVE-2022-35297",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35297"
},
{
"name": "CVE-2022-41197",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41197"
},
{
"name": "CVE-2022-41189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41189"
},
{
"name": "CVE-2022-41192",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41192"
},
{
"name": "CVE-2022-41180",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41180"
},
{
"name": "CVE-2022-41182",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41182"
},
{
"name": "CVE-2022-41167",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41167"
},
{
"name": "CVE-2022-41191",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41191"
},
{
"name": "CVE-2022-39805",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39805"
},
{
"name": "CVE-2022-41200",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41200"
},
{
"name": "CVE-2022-41210",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41210"
},
{
"name": "CVE-2022-39804",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39804"
},
{
"name": "CVE-2022-39800",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39800"
},
{
"name": "CVE-2021-41184",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41184"
},
{
"name": "CVE-2022-41178",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41178"
},
{
"name": "CVE-2022-41170",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41170"
},
{
"name": "CVE-2022-35226",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35226"
},
{
"name": "CVE-2022-41195",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41195"
},
{
"name": "CVE-2022-41201",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41201"
},
{
"name": "CVE-2022-32244",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32244"
},
{
"name": "CVE-2022-41209",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41209"
},
{
"name": "CVE-2022-41202",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41202"
},
{
"name": "CVE-2022-41172",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41172"
},
{
"name": "CVE-2022-41190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41190"
},
{
"name": "CVE-2022-41204",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41204"
},
{
"name": "CVE-2022-41171",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41171"
},
{
"name": "CVE-2022-41199",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41199"
},
{
"name": "CVE-2022-41176",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41176"
},
{
"name": "CVE-2022-41198",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41198"
},
{
"name": "CVE-2022-41181",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41181"
},
{
"name": "CVE-2022-41166",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41166"
},
{
"name": "CVE-2022-39013",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39013"
},
{
"name": "CVE-2022-41184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41184"
},
{
"name": "CVE-2022-35292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35292"
},
{
"name": "CVE-2022-39802",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39802"
},
{
"name": "CVE-2022-31596",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31596"
},
{
"name": "CVE-2022-39015",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39015"
},
{
"name": "CVE-2022-41196",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41196"
},
{
"name": "CVE-2022-41186",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41186"
},
{
"name": "CVE-2022-41187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41187"
},
{
"name": "CVE-2022-39806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39806"
},
{
"name": "CVE-2022-41177",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41177"
},
{
"name": "CVE-2022-41173",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41173"
},
{
"name": "CVE-2022-41188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41188"
},
{
"name": "CVE-2022-41179",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41179"
},
{
"name": "CVE-2022-41194",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41194"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-904",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-10-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 12 octobre 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2022-AVI-1101
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Sourcing and SAP Contract Lifecycle Management version 1100 | ||
| SAP | N/A | SAP Business Objects Business Intelligence Platform (Web intelligence) versions 420, 430 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420, 430 | ||
| SAP | N/A | SAP Commerce Webservices 2.0 (Swagger UI) versions 1905, 2005, 2105, 2011, 2205 | ||
| SAP | N/A | SAP NetWeaver Process Integration version 7.50 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420, 430 | ||
| SAP | N/A | SAP NetWeaver AS pour Java (Http Provider Service) version 7.50 | ||
| SAP | N/A | SAP Solution Manager (Diagnostic Agent) version 7.20 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005, 2105, 2011, 2205 | ||
| SAP | N/A | SAP Solution Manager (Enterprise Search) versions 740, 750 | ||
| SAP | N/A | SAP Disclosure Management version 10.1 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0, 7.70 | ||
| SAP | N/A | SAP NetWeaver AS ABAP (Business ServerPages Test Application IT00) versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 | ||
| SAP | N/A | SAPUI5 versions 754, 755, 756, 757 | ||
| SAP | N/A | SAP Business Planning et Consolidation versions SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 8103229132 | ||
| SAP | N/A | SAPBASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791 | ||
| SAP | N/A | SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789, 790 | ||
| SAP | N/A | SAPUI5 CLIENT RUNTIME versions 600, 700, 800, 900, 1000 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Sourcing and SAP Contract Lifecycle Management version 1100",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Objects Business Intelligence Platform (Web intelligence) versions 420, 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce Webservices 2.0 (Swagger UI) versions 1905, 2005, 2105, 2011, 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Program Objects) versions 420, 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS pour Java (Http Provider Service) version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager (Diagnostic Agent) version 7.20",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005, 2105, 2011, 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager (Enterprise Search) versions 740, 750",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Disclosure Management version 10.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0, 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP (Business ServerPages Test Application IT00) versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions 754, 755, 756, 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Planning et Consolidation versions SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 8103229132",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPBASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server and ABAP Platform versions 700, 701, 702, 731, 740, 750-757, 789, 790",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 CLIENT RUNTIME versions 600, 700, 800, 900, 1000",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41266",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41266"
},
{
"name": "CVE-2022-41273",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41273"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2022-41263",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41263"
},
{
"name": "CVE-2022-41261",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41261"
},
{
"name": "CVE-2022-41264",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41264"
},
{
"name": "CVE-2022-42889",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42889"
},
{
"name": "CVE-2022-41268",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41268"
},
{
"name": "CVE-2022-41275",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41275"
},
{
"name": "CVE-2022-41271",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41271"
},
{
"name": "CVE-2020-6215",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-6215"
},
{
"name": "CVE-2022-39013",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39013"
},
{
"name": "CVE-2022-35737",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35737"
},
{
"name": "CVE-2022-41262",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41262"
},
{
"name": "CVE-2022-41215",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41215"
},
{
"name": "CVE-2022-41274",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41274"
},
{
"name": "CVE-2022-41267",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41267"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-1101",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-12-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 13 d\u00e9cembre 2022",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026todaysdate=2022-12-14"
}
]
}
GHSA-HJMR-8X7C-687C
Vulnerability from github – Published: 2022-10-12 12:00 – Updated: 2022-10-14 19:00
VLAI?
Details
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.
Severity ?
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2022-39013"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-11T21:15:00Z",
"severity": "HIGH"
},
"details": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.",
"id": "GHSA-hjmr-8x7c-687c",
"modified": "2022-10-14T19:00:40Z",
"published": "2022-10-12T12:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39013"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3229132"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
WID-SEC-W-2022-2290
Vulnerability from csaf_certbund - Published: 2022-12-12 23:00 - Updated: 2023-05-31 22:00Summary
SAP Patchday Dezember 2022
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
- Sonstiges
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux\n- MacOS X\n- Windows\n- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-2290 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-2290.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-2290 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-2290"
},
{
"category": "external",
"summary": "SAP Patchday December 2022 vom 2022-12-12",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=10"
}
],
"source_lang": "en-US",
"title": "SAP Patchday Dezember 2022",
"tracking": {
"current_release_date": "2023-05-31T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:39:42.216+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2022-2290",
"initial_release_date": "2022-12-12T23:00:00.000+00:00",
"revision_history": [
{
"date": "2022-12-12T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-05-31T22:00:00.000+00:00",
"number": "2",
"summary": "CVE Nummern erg\u00e4nzt"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T016476",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-42889",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-42889"
},
{
"cve": "CVE-2022-41275",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41275"
},
{
"cve": "CVE-2022-41274",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41274"
},
{
"cve": "CVE-2022-41273",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41273"
},
{
"cve": "CVE-2022-41272",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41272"
},
{
"cve": "CVE-2022-41271",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41271"
},
{
"cve": "CVE-2022-41268",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41268"
},
{
"cve": "CVE-2022-41267",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41267"
},
{
"cve": "CVE-2022-41266",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41266"
},
{
"cve": "CVE-2022-41264",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41264"
},
{
"cve": "CVE-2022-41263",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41263"
},
{
"cve": "CVE-2022-41262",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41262"
},
{
"cve": "CVE-2022-41261",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41261"
},
{
"cve": "CVE-2022-41215",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-41215"
},
{
"cve": "CVE-2022-39013",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-39013"
},
{
"cve": "CVE-2022-35737",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-35737"
},
{
"cve": "CVE-2022-35299",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-35299"
},
{
"cve": "CVE-2022-32240",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-32240"
},
{
"cve": "CVE-2022-32235",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2022-32235"
},
{
"cve": "CVE-2020-6215",
"notes": [
{
"category": "description",
"text": "In den folgenden SAP-Anwendungskomponenten bestehen mehrere Schwachstellen, die nicht \u00f6ffentlich beschrieben wurden: SAP BusinessObjects Business Intelligence Platform, NetWeaver Process Integration, Commerce, BASIS, Business Planning and Consolidation, Disclosure Management, NetWeaver AS for Java, Solution Manager, Sourcing und Contract Lifecycle Management. Beschreibungen und Updates f\u00fcr diese Schwachstellen finden Sie in den SAP-Sicherheitshinweisen. Um einige dieser Schwachstellen auszunutzen, sind Benutzerinteraktion oder privilegierte Rechte erforderlich."
}
],
"product_status": {
"known_affected": [
"T016476"
]
},
"release_date": "2022-12-12T23:00:00.000+00:00",
"title": "CVE-2020-6215"
}
]
}
FKIE_CVE-2022-39013
Vulnerability from fkie_nvd - Published: 2022-10-11 21:15 - Updated: 2024-11-21 07:17
Severity ?
Summary
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.
References
| URL | Tags | ||
|---|---|---|---|
| cna@sap.com | https://launchpad.support.sap.com/#/notes/3229132 | Permissions Required, Vendor Advisory | |
| cna@sap.com | https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://launchpad.support.sap.com/#/notes/3229132 | Permissions Required, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| sap | business_objects_business_intelligence_platform | 420 | |
| sap | business_objects_business_intelligence_platform | 430 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:420:*:*:*:*:*:*:*",
"matchCriteriaId": "1F7F8064-45BC-4A01-897A-0A2893BBBEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*",
"matchCriteriaId": "6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application."
},
{
"lang": "es",
"value": "Bajo determinadas condiciones, un atacante autenticado puede obtener acceso a las credenciales del Sistema Operativo. Obtener acceso a las credenciales del Sistema Operativo permite al atacante modificar los datos del sistema y hacer que el sistema no est\u00e9 disponible, conllevando a un alto impacto en la Confidencialidad y un bajo impacto en la Integridad y disponibilidad de la aplicaci\u00f3n"
}
],
"id": "CVE-2022-39013",
"lastModified": "2024-11-21T07:17:22.510",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-11T21:15:13.943",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/3229132"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/3229132"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "cna@sap.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…