PT-2022-4932 · Sap · Sap Businessobjects

Published 2022-05-24 · Updated 2022-07-16 · CVE-2022-31598

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Objects version 420

Description The issue is related to insufficient input validation, allowing an authenticated attacker to submit a malicious request through an allowed operation. This can result in an attacker being able to view or modify information, causing a limited impact on the confidentiality and integrity of the application. The vulnerability is also associated with inadequate data authentication checks, which can enable a remote attacker to gain unauthorized access to protected information.

Recommendations For SAP Business Objects version 420, consider implementing additional input validation checks to prevent malicious requests. As a temporary workaround, restrict access to sensitive operations and data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2022-06113

CVE-2022-31598

Affected Products

Sap Businessobjects

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06113 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31598 · Security Note
• https://launchpad.support.sap.com/#/notes/3213279 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31598 · Vendor Advisory
• https://t.me/cibsecurity/46096 · Telegram Post