CVE-2022-39802

2022-10-1100:00:00

CWE-22

sap

www.cve.org

sap manufacturing execution

arbitrary traversal

information disclosure

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.3%

JSON

SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.

CNA Affected

[
  {
    "vendor": "SAP SE",
    "product": "SAP Manufacturing Execution",
    "versions": [
      {
        "version": "15.1",
        "status": "affected"
      },
      {
        "version": "15.2",
        "status": "affected"
      },
      {
        "version": "15.3",
        "status": "affected"
      }
    ]
  }
]