// For flags

CVE-2022-41272

 

Severity Score

8.6
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.

Un atacante no autenticado a través de la red puede conectarse a una interfaz abierta expuesta a través de JNDI mediante User Defined Search (UDS) de SAP NetWeaver Process Integration (PI), versión 7.50, y hacer uso de una API de directorio y nombres abiertos para acceder a servicios que pueden ser se utiliza para realizar operaciones no autorizadas que afectan a los usuarios y a los datos en todo el sistema. Esto permite al atacante tener acceso de lectura completo a los datos del usuario, realizar modificaciones limitadas en los datos del usuario y degradar el rendimiento del sistema, lo que genera un alto impacto en la confidencialidad y un impacto limitado en la disponibilidad e integridad de la aplicación.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-21 CVE Reserved
  • 2022-12-13 CVE Published
  • 2022-12-13 First Exploit
  • 2024-07-05 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • CWE-306: Missing Authentication for Critical Function
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
 Netweaver Process Integration
Search vendor "Sap" for product "Netweaver Process Integration"
 7.50
Search vendor "Sap" for product "Netweaver Process Integration" and version "7.50"
-
Affected