PT-2022-15513 · Sap · Sap Web Dispatcher+1

Published 2022-02-09 · Updated 2022-10-25 · CVE-2022-22543

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) versions 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 8.04

Description The software does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected.

Recommendations For versions 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 8.04, consider implementing additional validation for sap-passport information to prevent Denial-of-Service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-22543

Affected Products

Sap Netweaver Application Server Abap

Sap Web Dispatcher

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22543 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22543 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3116223 · Vendor Advisory
• https://t.me/cibsecurity/37181 · Telegram Post