Lucene search

[email protected]NVD:CVE-2022-28772

HistoryApr 12, 2022 - 5:15 p.m.

CVE-2022-28772

2022-04-1217:15:10

CWE-121

CWE-787

[email protected]

web.nvd.nist.gov

cve-2022-28772

overlong input values

sap web dispatcher

internet communication manager

stack overwrite

denial of service

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

40.6%

JSON

By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service.

Affected configurations

Nvd

Node

sapnetweaverMatch7.22ext

sapnetweaverMatch7.49

sapnetweaverMatch7.53

sapnetweaverMatch7.77

sapnetweaverMatch7.81

sapnetweaverMatch7.85

sapnetweaverMatch7.86

sapnetweaverMatchkernel_7.22

sapnetweaverMatchkrnl64nuc_7.22

sapnetweaverMatchkrnl64uc_7.22

sapweb_dispatcherMatch7.53

sapweb_dispatcherMatch7.77

sapweb_dispatcherMatch7.81

sapweb_dispatcherMatch7.85

sapweb_dispatcherMatch7.86

VendorProductVersionCPE
sapnetweaver7.22extcpe:2.3:a:sap:netweaver:7.22ext:*:*:*:*:*:*:*
sapnetweaver7.49cpe:2.3:a:sap:netweaver:7.49:*:*:*:*:*:*:*
sapnetweaver7.53cpe:2.3:a:sap:netweaver:7.53:*:*:*:*:*:*:*
sapnetweaver7.77cpe:2.3:a:sap:netweaver:7.77:*:*:*:*:*:*:*
sapnetweaver7.81cpe:2.3:a:sap:netweaver:7.81:*:*:*:*:*:*:*
sapnetweaver7.85cpe:2.3:a:sap:netweaver:7.85:*:*:*:*:*:*:*
sapnetweaver7.86cpe:2.3:a:sap:netweaver:7.86:*:*:*:*:*:*:*
sapnetweaverkernel_7.22cpe:2.3:a:sap:netweaver:kernel_7.22:*:*:*:*:*:*:*
sapnetweaverkrnl64nuc_7.22cpe:2.3:a:sap:netweaver:krnl64nuc_7.22:*:*:*:*:*:*:*
sapnetweaverkrnl64uc_7.22cpe:2.3:a:sap:netweaver:krnl64uc_7.22:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver	7.22ext	cpe:2.3:a:sap:netweaver:7.22ext:::::::*
sap	netweaver	7.49	cpe:2.3:a:sap:netweaver:7.49:::::::*
sap	netweaver	7.53	cpe:2.3:a:sap:netweaver:7.53:::::::*
sap	netweaver	7.77	cpe:2.3:a:sap:netweaver:7.77:::::::*
sap	netweaver	7.81	cpe:2.3:a:sap:netweaver:7.81:::::::*
sap	netweaver	7.85	cpe:2.3:a:sap:netweaver:7.85:::::::*
sap	netweaver	7.86	cpe:2.3:a:sap:netweaver:7.86:::::::*
sap	netweaver	kernel_7.22	cpe:2.3:a:sap:netweaver:kernel_7.22:::::::*
sap	netweaver	krnl64nuc_7.22	cpe:2.3:a:sap:netweaver:krnl64nuc_7.22:::::::*
sap	netweaver	krnl64uc_7.22	cpe:2.3:a:sap:netweaver:krnl64uc_7.22:::::::*

Rows per page:

1-10 of 151

References

launchpad.support.sap.com/#/notes/3111311

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

40.6%

JSON

Related for NVD:CVE-2022-28772

cvelist1 prion1 cve1