Insufficient Input Validation Vulnerability in SAP NetWeaver Application Server ABAP
CVE-2022-41214

8.7HIGH

Key Information:

Vendor
SAP
Status
SAP Netweaver Application Server Abap And Abap Platform
Vendor
CVE Published:
8 November 2022

Summary

The SAP NetWeaver Application Server ABAP and ABAP Platform are susceptible to an attack due to insufficient input validation. This vulnerability permits an attacker with elevated privileges to invoke a remote-enabled function that can delete restricted files. If exploited, this could lead to severe risks, including compromising the integrity and availability of the application, potentially allowing unauthorized access and manipulation of critical data.

Affected Version(s)

SAP NetWeaver Application Server ABAP and ABAP Platform = 700 = 700

SAP NetWeaver Application Server ABAP and ABAP Platform = 731 = 731

SAP NetWeaver Application Server ABAP and ABAP Platform = 804 = 804

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...
https://launchpad.support.sap.com/#/notes/3256571

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.