CVE-2022-22543

SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3116223	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory
https://launchpad.support.sap.com/#/notes/3116223	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:netweaver_abap:7.22:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.22ext:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.49:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.53:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.77:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.81:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.85:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.86:::::::*
	cpe:2.3:a:sap:netweaver_abap:7.87:::::::*
	cpe:2.3:a:sap:netweaver_abap:8.04:::::::*
	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:::::::*
	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_8.04:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.22:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.22ext:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.49:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.53:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.77:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.81:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.85:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.86:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:7.87:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:8.04:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:::::::*
	cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_8.04:::::::*

History

21 Nov 2024, 06:46

Type	Values Removed	Values Added
References	~~() https://launchpad.support.sap.com/#/notes/3116223 - Permissions Required, Vendor Advisory~~	() https://launchpad.support.sap.com/#/notes/3116223 - Permissions Required, Vendor Advisory
References	~~() https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory~~	() https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory

Information

Published : 2022-02-09 23:15

Updated : 2024-11-21 06:46

NVD link : CVE-2022-22543

Mitre link : CVE-2022-22543

CVE.ORG link : CVE-2022-22543

JSON object : View

Products Affected

sap

netweaver_as_abap
netweaver_abap

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2022-22543", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-02-09T23:15:18.913", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3116223", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/3116223", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected."}, {"lang": "es", "value": "SAP NetWeaver Application Server for ABAP (Kernel) y ABAP Platform (Kernel) - versiones KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, no comprueba suficientemente la informaci\u00f3n de sap-passport, lo que podr\u00eda conllevar un ataque de Denegaci\u00f3n de Servicio. Esto permite a un usuario remoto no autorizado provocar un bloqueo del proceso de trabajo del SAP Web Dispatcher o del Kernel. El proceso colapsado puede reiniciarse inmediatamente, los dem\u00e1s procesos no est\u00e1n afectados"}], "lastModified": "2024-11-21T06:46:59.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_abap:7.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFBA8C16-AD2E-4046-A22D-B8AB2A38DAD0"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.22ext:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A701B328-CC8D-4F10-8CDB-47883CAAC116"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.49:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "699E6EA8-1AA9-4C0E-A373-7E2F93E2F861"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.53:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A748DC7-E701-4E5B-9918-5CA6D7F52899"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.77:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E438D5E-F211-4361-AC2D-E86A7CE88026"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.81:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87B7FA96-2BA0-4328-8C97-31129E72D779"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.85:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BD5DBA8-4181-41C4-86B2-02615CACA6C4"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.86:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA794E5E-8C20-4B3A-BF1C-6F9A127F19D4"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:7.87:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1812ED28-5F27-4E43-88B5-55D0E37B4426"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:8.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D271FC7-E8B0-4323-9254-9AB9FCE08544"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE1BE43A-6659-4C08-8194-F85FA47D7D81"}, {"criteria": "cpe:2.3:a:sap:netweaver_abap:krnl64nuc_8.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B72A96D-9567-4A63-B336-A4FF44E55809"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5F6938B-667A-43C2-AF0E-42CD67B378B5"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.22ext:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46CD1D25-308E-474A-8837-55A363FD2159"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.49:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0C4499C-FADC-4B8F-8FD6-489D040FC566"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.53:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CCEC8BE-F106-475F-BFCF-1D2EFB05DECB"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.77:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9756558-70CB-44A8-B1D4-496426B9A820"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.81:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "370C6CD1-94C0-4639-8B63-01755B702F4E"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.85:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23AE7B69-8A79-4C2E-9C0A-52594F324E57"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.86:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "312D8ECD-195D-44C2-B040-C4D8BD088CC3"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:7.87:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5719E2B-20F7-4FD7-B51E-87CC76FD94FE"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:8.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F14E0EB-94CD-445C-BE80-97A27B11C3FB"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6A8D9F8-B501-450D-9632-320FBA5DFBAB"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_8.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2253203D-1B9E-4AFA-957E-EFF819502B35"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

JSON object

Attach tags to CVE-2022-22543

7.5^/10

5.0^/10

Attach tags to `CVE-2022-22543`