Remote Code Execution Vulnerability in SAP 3D Visual Enterprise Viewer
CVE-2022-41193

7.8HIGH

Key Information:

Vendor
SAP
Status
SAP 3d Visual Enterprise Viewer
Vendor
CVE Published:
11 October 2022

Summary

This vulnerability arises from improper memory management in SAP 3D Visual Enterprise Viewer, specifically when users open manipulated Encapsulated Post Script (.eps, .ai.x3d) files from untrusted sources. Attackers can exploit this flaw to trigger a remote code execution by manipulating stack-based overflow conditions or reusing a dangling pointer that references modified memory space, potentially allowing unauthorized actions within the affected system.

Affected Version(s)

SAP 3D Visual Enterprise Viewer 9

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...
https://launchpad.support.sap.com/#/notes/3245928

EPSS Score

15% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.