PT-2022-19728 · Eclipse+1 · Eclipse+1

Published 2022-06-14 · Updated 2022-06-24 · CVE-2022-29615

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Developer Studio version 7.50

Description The issue is related to the logging framework log4j in version 1.x, which is part of Eclipse and used by SAP NetWeaver Developer Studio. This could have a low impact on the application's confidentiality and integrity due to the vulnerabilities associated with log4j version 1.x.

Recommendations For SAP NetWeaver Developer Studio version 7.50, consider updating the log4j component to a version that is not affected by the vulnerabilities. As a temporary workaround, restrict the use of the log4j logging framework until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-29615

Affected Products

Eclipse

Sap Netweaver Developer Studio

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-29615 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3202846 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29615 · Vendor Advisory
• https://t.me/cibsecurity/44448 · Telegram Post