SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, 8.04, SAPHOSTAGENT 7.22, allows an authenticated user to misuse a function of sapcontrol webfunctionality(startservice) in Kernel which enables malicious users to retrieve information. On successful exploitation, an attacker can obtain technical information like system number or physical address, which is otherwise restricted, causing a limited impact on the confidentiality of the application.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3194674 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
22 Jun 2022, 20:49
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3194674 - Permissions Required, Vendor Advisory | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| CPE | cpe:2.3:a:sap:netweaver_abap:kernel_7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_8.04:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.85:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64uc_8.04:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.88:*:*:*:*:*:*:* cpe:2.3:a:sap:host_agent:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.86:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:kernel_7.87:*:*:*:*:*:*:* |
14 Jun 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-14 17:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-29612
Mitre link : CVE-2022-29612
CVE.ORG link : CVE-2022-29612
JSON object : View
Products Affected
sap
- host_agent
- netweaver_abap
CWE
CWE-918
Server-Side Request Forgery (SSRF)