CVE-2022-27668

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Incorrect Authorization pada sap netweaver as abap, sap netweaver as abap krnl64nuc +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.

Rincian

Terbit di NVD

14 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://launchpad.support.sap.com/#/notes/3158375 permissions required · advisory vendor
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor
• http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html exploit · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Sep/17 exploit · mailing list · advisory pihak ketiga