PT-2022-3350 · Sap · Sap Adaptive Server Enterprise

Published 2022-05-24 · Updated 2022-06-24 · CVE-2022-31594

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Adaptive Server Enterprise (affected versions not specified) SUID-root program (affected versions not specified)

Description The issue is related to a highly privileged user exploiting a SUID-root program to escalate privileges to root on a local Unix system. It is also associated with insufficient access control in the SAP Adaptive Server Enterprise database, which can allow an attacker to elevate their privileges.

Recommendations For SAP Adaptive Server Enterprise, restrict access to sensitive areas of the database to minimize the risk of exploitation. For SUID-root program, consider disabling the program until a patch is available to prevent local privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-04108

CVE-2022-31594

Affected Products

Sap Adaptive Server Enterprise

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04108 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31594 · Security Note
• https://launchpad.support.sap.com/#/notes/3155571 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31594 · Vendor Advisory
• https://absoft.co.uk/what-is-the-sap-kernel-and-why-should-i-care · Note
• https://t.me/cibsecurity/44451 · Telegram Post