PT-2022-18553 · Sap · Sap Focused Run

Yvan Genuer · Published 2022-04-12 · Updated 2023-02-01 · CVE-2022-27657

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Focused Run (Simple Diagnostics Agent 1.0) version 1.0

Description A highly privileged remote attacker can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information.

Recommendations For SAP Focused Run (Simple Diagnostics Agent 1.0) version 1.0, consider restricting access to sensitive directories until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-27657

Affected Products

Sap Focused Run

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27657 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27657 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3159091 · Vendor Advisory
• https://t.me/cvenotify/31976 · Telegram Post
• http://packetstormsecurity.com/files/167563/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Directory-Traversal.html · Note
• https://t.me/cvenotify/29231 · Telegram Post
• http://seclists.org/fulldisclosure/2022/Jun/41 · Note