Lucene search

[email protected]CVE-2022-27668

HistoryJun 14, 2022 - 5:15 p.m.

CVE-2022-27668

2022-06-1417:15:08

CWE-863

[email protected]

web.nvd.nist.gov

sap

saprouter

unauthenticated access

remote execution

vulnerability

nvd

cve-2022-27668

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.1%

JSON

Depending on the configuration of the route permission table in file ‘saprouttab’, it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.

Affected configurations

NVD

Node

sapnetweaver_as_abapMatchkernel_7.49

sapnetweaver_as_abapMatchkernel_7.77

sapnetweaver_as_abapMatchkernel_7.81

sapnetweaver_as_abapMatchkernel_7.85

sapnetweaver_as_abapMatchkernel_7.86

sapnetweaver_as_abapMatchkernel_7.87

sapnetweaver_as_abapMatchkernel_7.88

sapnetweaver_as_abap_krnl64nucMatch7.49

sapnetweaver_as_abap_krnl64ucMatch7.49

saprouterMatch7.22

saprouterMatch7.53

CPENameOperatorVersion
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.49
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.77
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.81
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.85
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.86
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.87
sap:netweaver_as_abapsap netweaver as abapeqkernel_7.88
sap:netweaver_as_abap_krnl64nucsap netweaver as abap krnl64nuceq7.49
sap:netweaver_as_abap_krnl64ucsap netweaver as abap krnl64uceq7.49
sap:routersap routereq7.22

CPE	Name	Operator	Version
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.49
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.77
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.81
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.85
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.86
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.87
sap:netweaver_as_abap	sap netweaver as abap	eq	kernel_7.88
sap:netweaver_as_abap_krnl64nuc	sap netweaver as abap krnl64nuc	eq	7.49
sap:netweaver_as_abap_krnl64uc	sap netweaver as abap krnl64uc	eq	7.49
sap:router	sap router	eq	7.22

Rows per page:

1-10 of 111

CNA Affected

[
  {
    "product": "SAP NetWeaver and ABAP Platform",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "KERNEL 7.49"
      },
      {
        "status": "affected",
        "version": "7.77"
      },
      {
        "status": "affected",
        "version": "7.81"
      },
      {
        "status": "affected",
        "version": "7.85"
      },
      {
        "status": "affected",
        "version": "7.86"
      },
      {
        "status": "affected",
        "version": "7.87"
      },
      {
        "status": "affected",
        "version": "7.88"
      },
      {
        "status": "affected",
        "version": "KRNL64NUC 7.49"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 7.49"
      },
      {
        "status": "affected",
        "version": "SAP_ROUTER 7.53"
      },
      {
        "status": "affected",
        "version": "7.22"
      }
    ]
  }
]

References

packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html

seclists.org/fulldisclosure/2022/Sep/17

launchpad.support.sap.com/#/notes/3158375

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.1%

JSON

Related for CVE-2022-27668

nessus1 packetstorm1 prion1 cvelist1 nvd1