PT-2022-18562 · Sap · Sap Sql Anywhere

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-27670

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP SQL Anywhere version 17.0

Description The issue allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use indirect identifiers.

Recommendations For SAP SQL Anywhere version 17.0, consider restricting access to queries that use indirect identifiers until a patch is available. As a temporary workaround, monitor server activity closely to quickly respond to potential crashes caused by malicious queries.

Fix

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2022-27670

Affected Products

Sap Sql Anywhere

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27670 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27670 · Security Note
• https://launchpad.support.sap.com/#/notes/3148094 · Vendor Advisory
• https://t.me/cibsecurity/40653 · Telegram Post