PT-2022-25776 · Sap · Sap Basis

Published 2022-12-13 · Updated 2022-12-15 · CVE-2022-41264

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791

Description The issue allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation, the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application.

Recommendations For SAP BASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, consider restricting access to the RFC function module to prevent unauthorized execution of system class methods. As a temporary workaround, consider disabling the public methods of the system class until a patch is available. Restrict access to system classes to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-41264

Affected Products

Sap Basis

References · 6

• https://launchpad.support.sap.com/#/notes/3268172 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41264 · Security Note
• https://t.me/cvenotify/39957 · Telegram Post
• https://t.me/cibsecurity/54371 · Telegram Post