PT-2022-3954 · Sap · Sap Hana+1

Published 2022-06-02 · Updated 2023-01-30 · CVE-2022-32249

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business One and SAP HANA versions prior to 10.0

Description The issue is related to insufficient access control in the Cockpit component of SAP Business One and SAP HANA systems, allowing a remote attacker to gain unauthorized access to sensitive information. Under specific integration scenarios, an attacker can exploit the HANA cockpit's data volume to access highly sensitive information, such as high-privileged account credentials.

Recommendations For SAP Business One and SAP HANA versions prior to 10.0, update to version 10.0 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2022-04786

CVE-2022-32249

Affected Products

Sap Business One

Sap Hana

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3212997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32249 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04786 · Security Note
• https://t.me/true_secator/3176 · Telegram Post
• https://vuldb.com/ru/?id.203782 · Note