PT-2022-6162 · Sap · Sap Customer Data Cloud

Published 2022-10-11 · Updated 2022-10-12 · CVE-2022-41210

Positive Technologies (AI Summary)

CVSS v2.0

5.6

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Customer Data Cloud (Gigya mobile app for Android) version 7.4

Description The issue is related to the use of an insecure random number generator program, which makes it easy for an attacker to predict future random numbers. This can lead to information disclosure and modification of certain user settings. The vulnerability can be exploited by a remote attacker to disclose protected information.

Recommendations For version 7.4, consider disabling the use of the insecure random number generator program until a secure alternative is implemented. As a temporary workaround, restrict access to sensitive user settings to minimize the risk of exploitation. Avoid using the affected app for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

BDU:2023-00259

CVE-2022-41210

Affected Products

Sap Customer Data Cloud

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41210 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41210 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3248384 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00259 · Security Note