Summary
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.
Product
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Vulnerabilities 20
-
Critical 9.9
SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/repl…
-
Critical 9.9CVE-2022-41272 Public exploit
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined S…
-
Critical 9.8
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…
-
Critical 9.4
An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver P…
-
High 8.8
Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, …
-
High 8.5
In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755,…
-
High 8.0
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, …
-
High 7.5
`libsqlite3-sys` via C SQLite improperly validates array index
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
-
Medium 6.5
SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application…
-
Medium 6.1
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthent…
-
Medium 6.1
In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link th…
-
Medium 6.0
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a …
-
Medium 4.7
SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site du…
-
Medium 4.3
Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - version…
-
Medium 4.3
Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker ca…
-
Unscored —
When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visu…
-
Unscored —
When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D V…
-
Unscored —
SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory man…
-
Unscored —
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials e…
Revision history
-
#2
CVE Nummern ergänzt
-
#1
Initiale Fassung
References
-
SAP Patchday December 2022 vom 2022-12-12
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10