PT-2022-18561 · Sap · Sap Netweaver Application Server Java

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-27669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java version 7.50

Description The issue allows an unauthenticated user to use functions of the XML Data Archiving Service, which may result in an escalation of privileges. Access to these functions should be restricted.

Recommendations For version 7.50, restrict access to the XML Data Archiving Service functions to prevent unauthorized use and potential privilege escalation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-27669

Affected Products

Sap Netweaver Application Server Java

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27669 · Security Note
• https://launchpad.support.sap.com/#/notes/3152442 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27669 · Vendor Advisory
• https://t.me/cibsecurity/40650 · Telegram Post