PT-2022-25780 · Sap · Sap Netweaver Process Integration

Published 2022-12-13 · Updated 2022-12-15 · CVE-2022-41271

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration (PI) version 7.50

Description The issue allows an unauthenticated user to attach to an open interface exposed through JNDI by the Messaging System, making use of an open naming and directory API to access services that could perform unauthorized operations. This affects local users and data, leading to a considerable impact on confidentiality and availability, and a limited impact on the integrity of the application. The unauthorized operations can be used to read any information, modify sensitive information, conduct Denial of Service attacks, and perform SQL Injection.

Recommendations For SAP NetWeaver Process Integration (PI) version 7.50, consider restricting access to the open interface exposed through JNDI to minimize the risk of exploitation. As a temporary workaround, limit the use of the open naming and directory API until a patch is available. Avoid using the vulnerable API for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Missing Authorization

SQL injection

Weakness Enumeration

CWE-306

CWE-862

CWE-89

Related Identifiers

CVE-2022-41271

Affected Products

Sap Netweaver Process Integration

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3267780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41271 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41271 · Vendor Advisory
• https://t.me/cibsecurity/54377 · Telegram Post