Lucene search

SapCVE-2022-28771

HistoryJul 12, 2022 - 9:15 p.m.

CVE-2022-28771

2022-07-1221:15:09

CWE-306

sap

web.nvd.nist.gov

573

sap

business

license service

api

v10.0

vulnerability

cve-2022-28771

nvd

security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

43.7%

JSON

Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.

Affected configurations

Nvd

Node

sapbusiness_one_license_service_apiMatch10.0

VendorProductVersionCPE
sapbusiness_one_license_service_api10.0cpe:2.3:a:sap:business_one_license_service_api:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	business_one_license_service_api	10.0	cpe:2.3:a:sap:business_one_license_service_api:10.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Business One License service API",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "10.0"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3157613

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

43.7%

JSON

Related for CVE-2022-28771