PT-2022-15497 · Sap+1 · Sap Adaptive Server Enterprise+1

Published 2022-02-09 · Updated 2023-08-14 · CVE-2022-22528

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Adaptive Server Enterprise (ASE) version 16.0

Description The issue arises during the installation of SAP Adaptive Server Enterprise (ASE) on the Windows platform, where an entry is made in the system PATH environment variable. Under certain conditions, this allows a Standard User to execute malicious Windows binaries, potentially leading to privilege escalation on the local system. The problem is specifically with the ASE installer and does not affect other ASE binaries.

Recommendations For SAP Adaptive Server Enterprise (ASE) version 16.0, consider removing the entry made in the system PATH environment variable by the installer as a temporary workaround to minimize the risk of exploitation. Ensure that any malicious Windows binaries are removed from the system to prevent potential privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2022-22528

Affected Products

Sap Adaptive Server Enterprise

Windows

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3140564 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22528 · Security Note
• https://t.me/cvenotify/55020 · Telegram Post
• https://t.me/cvenotify/56396 · Telegram Post