{"vulnerability": "CVE-2022-39802", "sightings": [{"uuid": "343b8acc-967b-42b0-8cd5-416070051920", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/true_secator/3562", "content": "\u041d\u0435\u043c\u0435\u0446\u043a\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u041f\u041e SAP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b 15 \u043d\u043e\u0432\u044b\u0445 \u0437\u0430\u043c\u0435\u0442\u043e\u043a \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Patch Tuesday, \u0437\u0430\u043a\u0440\u044b\u0432 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0438\u0437 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f CVE-2022-39802 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 9,9), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 \u043a \u0444\u0430\u0439\u043b\u0443 \u0432 Manufacturing Execution.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0438 Visual Test and Repair \u2014 \u0434\u0432\u0430 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0434\u043b\u044f \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0438 \u043c\u043e\u0434\u0435\u043b\u0435\u0439.\n\nURL-\u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043f\u0443\u0442\u0438 \u043a \u0444\u0430\u0439\u043b\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0445\u043e\u0434 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0421\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043d\u043e \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u041e\u0421, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0438\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u0443 NetWeaver.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-41204 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 9,6) \u0432\u043b\u0438\u044f\u0435\u0442 \u043d\u0430 \u0444\u043e\u0440\u043c\u0443 \u0432\u0445\u043e\u0434\u0430 \u0432 SAP Commerce \u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 URL.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e URL-\u0430\u0434\u0440\u0435\u0441\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0444\u043e\u0440\u043c\u044b \u0432\u0445\u043e\u0434\u0430, \u043d\u0435 \u043e\u0447\u0438\u0449\u0430\u044e\u0442\u0441\u044f \u0434\u043e\u043b\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432 \u043d\u0438\u0445 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a\u0438\u0435-\u043b\u0438\u0431\u043e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u0433\u043b\u0430\u0432\u043d\u043e\u0435, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0449\u0435\u043b\u043a\u043d\u0443\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0444\u043e\u0440\u043c\u0443 \u0432\u0445\u043e\u0434\u0430 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.\n\nSAP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430\u00a0\u043f\u044f\u0442\u044c \u043d\u043e\u0432\u044b\u0445 \u0438 \u043e\u0434\u043d\u0443 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u043c\u0435\u0442\u043a\u0443 \u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0442\u0440\u0438, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 BusinessObjects, \u0438 \u043e\u0434\u043d\u0443, \u043a\u0430\u0441\u0430\u044e\u0449\u0443\u044e\u0441\u044f \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 SQL Anywhere \u0438 IQ.\n\n\u0414\u0432\u0435 \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0434\u044b\u0440\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 3D Visual Enterprise Viewer (17 \u043f\u0440\u043e\u0431\u043b\u0435\u043c) \u0438 3D Visual Enterprise Author (26 \u043e\u0448\u0438\u0431\u043e\u043a).\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043c\u0430\u043d\u043e\u043c \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 3D Visual Enterprise Viewer/Author, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a RCE \u0438\u043b\u0438 DoS.\n\n\u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0435\u0432\u044f\u0442\u044c \u0437\u0430\u043c\u0435\u0447\u0430\u043d\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 SAP \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435, \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0438 \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 (XSS) \u0432 BusinessObjects, Enable Now, Commerce, Customer Data Cloud (Gigya) \u0438 Data Services Management Console.", "creation_timestamp": "2022-10-14T12:09:53.000000Z"}, {"uuid": "46ecc7ac-274a-4d4c-bc43-0fcda67b1de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/CVEhub/3589", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-39802\nGithub: https://github.com/redrays-io/CVE-2022-39802\nDescribe: \nSAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.", "creation_timestamp": "2026-07-30T01:00:59.878082Z"}, {"uuid": "16448d9c-7f60-4a36-922e-6a38fd37b93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2764", "content": "3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution https://redrays.io/3242933-cve-2022-39802-file-path-traversal-vulnerability-in-sap-manufacturing-execution/", "creation_timestamp": "2026-08-02T22:18:46.054960Z"}, {"uuid": "bc9fb174-55ff-4e90-8ebf-440cd6e64107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2764", "content": "3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution https://redrays.io/3242933-cve-2022-39802-file-path-traversal-vulnerability-in-sap-manufacturing-execution/", "creation_timestamp": "2026-08-03T01:27:32.209997Z"}, {"uuid": "d1dbe9df-7f21-4fd3-84b8-4e40083c867f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/3589", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-39802\nGithub: https://github.com/redrays-io/CVE-2022-39802\nDescribe: \nSAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.", "creation_timestamp": "2026-08-02T00:01:21.251397Z"}, {"uuid": "075f8aff-ebb4-412f-8c7b-592f492f39fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/3589", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-39802\nGithub: https://github.com/redrays-io/CVE-2022-39802\nDescribe: \nSAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.", "creation_timestamp": "2026-08-01T01:00:05.110307Z"}, {"uuid": "a2e5db7c-bbe2-4a60-bed4-c79c715ad40f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/CVEhub/3589", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-39802\nGithub: https://github.com/redrays-io/CVE-2022-39802\nDescribe: \nSAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.", "creation_timestamp": "2026-07-29T12:00:58.332349Z"}, {"uuid": "442e11c6-4f6f-420e-9a3c-832199393941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/reverseame/2764", "content": "3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution https://redrays.io/3242933-cve-2022-39802-file-path-traversal-vulnerability-in-sap-manufacturing-execution/", "creation_timestamp": "2026-07-29T12:02:38.248100Z"}, {"uuid": "b36e887b-1e35-4454-bdf6-1ac9bb43a81a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/reverseame/2764", "content": "3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution https://redrays.io/3242933-cve-2022-39802-file-path-traversal-vulnerability-in-sap-manufacturing-execution/", "creation_timestamp": "2026-07-30T00:02:34.605581Z"}, {"uuid": "40f7c23d-0c7f-42c4-adbd-b54d5c552a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/hacking_Attack/73246", "content": "Exploit Collector\nSAP Manufacturing Execution Core 15.3 Path Traversal\n\nhttps://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png \nSAP Manufacturing Execution Core versions 15.1 through 15.3 suffer from a path traversal vulnerability.\n\nSHA-256 | d2c66b61de7a4021d8a7f4c40b09c163f1f708ce3aa8581767e5edaefd4cc198\n\nDownload\nTITLE: 3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution\n\nGeneral information\nRisk: CRITICAL\nVersions Affected:\nSAP MFG EXECUTION CORE 15.1\nSAP MFG EXECUTION CORE 15.2\nSAP MFG EXECUTION CORE 15.3\nVendor URL: https://sap.com\nBug: File path traversal vulnerability\nReported: September 2022\nDate of Public Advisory: October 12, 2022\nReference: SAP Security Note  3242933\nAuthor: RedRays R&D\n\nDescription\nADVISORY INFORMATION\nTitle: 3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution\nAdvisory: [RedRays-22-031]\nDate published: 12.10.2022\n\nVULNERABILITY INFORMATION\nRemotely Exploitable: Yes\nLocally Exploitable: No\n\nCVSS Information\nCVSS v3 Base Score: 9.9 / 10 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\nVULNERABILITY DESCRIPTION\nWith a CVSS rating of 9.9, the vulnerability fixed in SAP Security Note #3242933 affects SAP Manufacturing Execution and is considered significant.\n\nThe URL used to inquire for this data included a file path argument that could be modified to provide unrestricted directory browsing on the remote server. The OS user running the NetWeaver process or service would be able to access the files contained in each directory. The code fix in the patch takes care of the route internally. This prevents the value from being sent in dynamically as a query string. With a CVSS score of 9.9, the effect on confidentiality, integrity, and availability may be quite substantial depending on the kind of information that is accessed during an attack.\n\nSAP suggests a temporary fix in which sensitive data is removed from the file systems available to the OS user and the OS user\u2019s access to unnecessary file paths is restricted.\n\nTECHNICAL DESCRIPTION\n\nPoC will be published in January 2023.\n\nThe signature of the vulnerability is available on the RedRays Security Platform.\n\nABOUT RedRays\nThe main goal of RedRays is to narrow the security gap in both the technical and business realms. The company offers solutions to examine and protect SAP, Oracle, and Microsoft ERP systems against cyberattacks and internal fraud.\n\nTypically, our customers are big organizations and managed service providers whose needs include the active monitoring and management of security across extensive SAP environments worldwide.\nABOUT RedRays R&D\nThe company\u2019s competence is founded on RedRays\u2019 research section, which specializes in vulnerability research and analysis of essential corporate applications. It has received several accolades from major software companies, including SAP, Oracle, Microsoft Dynamics, and IBM.\n\nExperts from RedRays have been asked to lecture, present, and train at major international security conferences on all continents.\nAddress: Casablanca, Morocco\nPhone: (+32)489-16-78-85\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:20.209037Z"}, {"uuid": "f119d5a8-75c4-4913-92a9-8ec04620167b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39802", "type": "seen", "source": "https://t.me/hacking_Attack/73246", "content": "Exploit Collector\nSAP Manufacturing Execution Core 15.3 Path Traversal\n\nhttps://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png \nSAP Manufacturing Execution Core versions 15.1 through 15.3 suffer from a path traversal vulnerability.\n\nSHA-256 | d2c66b61de7a4021d8a7f4c40b09c163f1f708ce3aa8581767e5edaefd4cc198\n\nDownload\nTITLE: 3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution\n\nGeneral information\nRisk: CRITICAL\nVersions Affected:\nSAP MFG EXECUTION CORE 15.1\nSAP MFG EXECUTION CORE 15.2\nSAP MFG EXECUTION CORE 15.3\nVendor URL: https://sap.com\nBug: File path traversal vulnerability\nReported: September 2022\nDate of Public Advisory: October 12, 2022\nReference: SAP Security Note  3242933\nAuthor: RedRays R&D\n\nDescription\nADVISORY INFORMATION\nTitle: 3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution\nAdvisory: [RedRays-22-031]\nDate published: 12.10.2022\n\nVULNERABILITY INFORMATION\nRemotely Exploitable: Yes\nLocally Exploitable: No\n\nCVSS Information\nCVSS v3 Base Score: 9.9 / 10 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\nVULNERABILITY DESCRIPTION\nWith a CVSS rating of 9.9, the vulnerability fixed in SAP Security Note #3242933 affects SAP Manufacturing Execution and is considered significant.\n\nThe URL used to inquire for this data included a file path argument that could be modified to provide unrestricted directory browsing on the remote server. The OS user running the NetWeaver process or service would be able to access the files contained in each directory. The code fix in the patch takes care of the route internally. This prevents the value from being sent in dynamically as a query string. With a CVSS score of 9.9, the effect on confidentiality, integrity, and availability may be quite substantial depending on the kind of information that is accessed during an attack.\n\nSAP suggests a temporary fix in which sensitive data is removed from the file systems available to the OS user and the OS user\u2019s access to unnecessary file paths is restricted.\n\nTECHNICAL DESCRIPTION\n\nPoC will be published in January 2023.\n\nThe signature of the vulnerability is available on the RedRays Security Platform.\n\nABOUT RedRays\nThe main goal of RedRays is to narrow the security gap in both the technical and business realms. The company offers solutions to examine and protect SAP, Oracle, and Microsoft ERP systems against cyberattacks and internal fraud.\n\nTypically, our customers are big organizations and managed service providers whose needs include the active monitoring and management of security across extensive SAP environments worldwide.\nABOUT RedRays R&D\nThe company\u2019s competence is founded on RedRays\u2019 research section, which specializes in vulnerability research and analysis of essential corporate applications. It has received several accolades from major software companies, including SAP, Oracle, Microsoft Dynamics, and IBM.\n\nExperts from RedRays have been asked to lecture, present, and train at major international security conferences on all continents.\nAddress: Casablanca, Morocco\nPhone: (+32)489-16-78-85\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:35.020722Z"}]}