PT-2022-6134 · Sap · Sap Sql Anywhere

Published 2022-11-08 · Updated 2022-11-09 · CVE-2022-41259

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP SQL Anywhere version 17.0

Description The issue is related to the lack of protection for the SQL query structure in SAP SQL Anywhere. An authenticated attacker can exploit this by crashing the server with specially crafted queries that use an ARRAY constructor, preventing legitimate users from accessing the database server.

Recommendations For SAP SQL Anywhere version 17.0, consider restricting the use of the ARRAY constructor in queries until a patch is available. As a temporary workaround, limit access to the database server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-00149

CVE-2022-41259

Affected Products

Sap Sql Anywhere

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41259 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3229987 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00149 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41259 · Security Note
• https://t.me/cibsecurity/52691 · Telegram Post
• https://t.me/cvenotify/37319 · Telegram Post