PT-2022-6133 · Sap · Sap Disclosure Management

Published 2022-12-12 · Updated 2023-01-10 · CVE-2022-41274

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Disclosure Management version 10.1

Description The issue allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data, such as financial reports. These endpoints are normally exposed over the network, and successful exploitation can lead to the exposure of sensitive information. The vulnerability is related to authorization errors, which can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For SAP Disclosure Management version 10.1, consider restricting access to the misconfigured application endpoints to minimize the risk of exploitation. As a temporary workaround, review and correct the configuration of these endpoints to prevent unauthorized access. Ensure that all endpoints are properly secured and only accessible to authorized personnel. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

BDU:2023-00148

CVE-2022-41274

Affected Products

Sap Disclosure Management

References · 9

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41274 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3266846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41274 · Security Note
• https://bdu.fstec.ru/vul/2023-00148 · Security Note
• https://d.dam.sap.com/a/3Hat4sC/2022%2012%20Patch%20Day%20Blog%20V9.0.pdf?rc=10 · Note
• https://github.com/advisories/GHSA-77h9-35pf-mgrp · Note
• https://vuldb.com/ru/?id.215351 · Note
• https://t.me/cibsecurity/54376 · Telegram Post