PT-2022-17670 · Sap · Sapcar

Published 2022-03-08 · Updated 2022-03-17 · CVE-2022-26100

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAPCAR version 7.22

Description The issue is related to insufficient input validation on the SAPCAR archive, which may cause the SAPCAR process to crash. This could potentially allow an attacker to gain privileged access to the system.

Recommendations For SAPCAR version 7.22, update to a version that contains sufficient input validation to prevent the SAPCAR process from crashing and to minimize the risk of privileged access to the system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

RCE

Weakness Enumeration

CWE-129

CWE-20

Related Identifiers

CVE-2022-26100

Affected Products

Sapcar

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-26100 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26100 · Vendor Advisory
• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3111110 · Vendor Advisory