PT-2022-25779 · Sap · Cpmbpc+3

Published 2022-12-13 · Updated 2022-12-15 · CVE-2022-41268

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Planning and Consolidation versions SAP BW 750 through 757, DWCORE 200 through 300, CPMBPC 810

Description The issue concerns the use of a transaction code reserved for the customer in some SAP standard roles. This could allow a malicious user to execute unauthorized transaction functionality. Under specific circumstances, a successful attack could enable an adversary to escalate their privileges, allowing them to read, change, or delete system data.

Recommendations For SAP Business Planning and Consolidation versions SAP BW 750 through 757, consider restricting access to the transaction code reserved for the customer until a fix is available. For DWCORE versions 200 through 300, restrict the use of the vulnerable transaction code to prevent unauthorized access. For CPMBPC version 810, limit the privileges of users who have access to the transaction code to minimize potential damage. As a temporary workaround, consider disabling the vulnerable transaction functionality until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-41268

Affected Products

Cpmbpc

Dwcore

Sap Business Planning/Consolidation

Sap Bw

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3271091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41268 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41268 · Vendor Advisory
• https://t.me/cibsecurity/54378 · Telegram Post