PT-2022-3347 · Sap · Sap Powerdesigner Proxy

Published 2022-05-24 · Updated 2022-06-24 · CVE-2022-31590

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP PowerDesigner Proxy version 16.7

Description The issue is related to a lack of proper quoting in SQL query elements or search paths in the SAP PowerDesigner Proxy service. An attacker with low privileges and local access can exploit this to create a program file on the system disk root path, which could then be executed with elevated privileges during application start-up or reboot. This could compromise the Confidentiality, Integrity, and Availability of the system.

Recommendations For SAP PowerDesigner Proxy version 16.7, consider restricting local access to the system and limiting the ability to write or create files on the system disk root path as a temporary mitigation measure. Ensure that all users with access to the system have the least privileges necessary to perform their tasks, and monitor the system for any unauthorized file creations or modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-428

Related Identifiers

BDU:2022-04104

CVE-2022-31590

Affected Products

Sap Powerdesigner Proxy

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-31590 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3197005 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31590 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04104 · Security Note
• https://vuldb.com/ru/?id.201924 · Note
• https://t.me/cibsecurity/44439 · Telegram Post