PT-2022-3937 · Sap · Sap Business One License Service Api

Published 2022-04-06 · Updated 2023-08-14 · CVE-2022-28771

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP Business One License service API version 10.0

Description The issue is related to a missing authentication check in the SAP Business One License service API, allowing an unauthenticated attacker to send malicious HTTP requests over the network. Successful exploitation can enable an attacker to break the whole application, making it inaccessible. The vulnerability can be exploited by a remote attacker using a specially crafted HTTP request, potentially allowing the execution of arbitrary code.

Recommendations For SAP Business One License service API version 10.0, consider implementing proper authentication checks to prevent unauthorized access. As a temporary workaround, restrict access to the API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2022-04766

CVE-2022-28771

Affected Products

Sap Business One License Service Api

References · 9

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28771 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28771 · Security Note
• https://t.me/true_secator/3176 · Telegram Post
• https://t.me/cibsecurity/46098 · Telegram Post
• https://vuldb.com/pt/?id.203774 · Note
• https://t.me/cvenotify/56397 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3157613 · Note