cnvd - cnvd-2022-41301

cnvd-2022-41301

Vulnerability from cnvd

Title: SAP Web Dispatcher和Internet Communication Manager拒绝服务漏洞

Description:

SAP Web dispatcher和SAP Internet Communication Manager（SAP ICM）都是德国思爱普（SAP）公司的产品。SAP Web dispatcher是Load Balancing 的核心组件，支持负载均衡，提供反向代理的功能，使得外网用户可以访问到内部应用。SAP Internet Communication Manager是一个SAP NetWeaver应用程序服务器的组件。用于接收和发送Web请求（HTTP、HTTPS、SMTP）。

SAP Web Dispatcher和SAP Internet Communication Manager存在拒绝服务漏洞，该漏洞源于递归未受控制，攻击者可利用该漏洞导致程序拒绝服务。

Severity: 中

Patch Name: SAP Web Dispatcher和Internet Communication Manager拒绝服务漏洞的补丁

Patch Description:

SAP Web Dispatcher和SAP Internet Communication Manager存在拒绝服务漏洞，该漏洞源于递归未受控制，攻击者可利用该漏洞导致程序拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://launchpad.support.sap.com/#/notes/3111293

Reference: https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Impacted products

Name
['SAP Internet Communication Manager 7.22EXT', 'SAP Internet Communication Manager 7.49', 'SAP Internet Communication Manager 7.53', 'SAP Internet Communication Manager 7.77', 'SAP Internet Communication Manager 7.81', 'SAP Web Dispatcher 7.53', 'SAP Web Dispatcher 7.77', 'SAP Web Dispatcher 7.81', 'SAP Web Dispatcher 7.85', 'SAP Web Dispatcher 7.86', 'SAP Internet Communication Manager KRNL64NUC 7.22', 'SAP Internet Communication Manager KRNL64UC 7.22', 'SAP Internet Communication Manager KERNEL 7.22', 'SAP Internet Communication Manager 7.85', 'SAP Internet Communication Manager 7.86']

Name

['SAP Internet Communication Manager 7.22EXT', 'SAP Internet Communication Manager 7.49', 'SAP Internet Communication Manager 7.53', 'SAP Internet Communication Manager 7.77', 'SAP Internet Communication Manager 7.81', 'SAP Web Dispatcher 7.53', 'SAP Web Dispatcher 7.77', 'SAP Web Dispatcher 7.81', 'SAP Web Dispatcher 7.85', 'SAP Web Dispatcher 7.86', 'SAP Internet Communication Manager KRNL64NUC 7.22', 'SAP Internet Communication Manager KRNL64UC 7.22', 'SAP Internet Communication Manager KERNEL 7.22', 'SAP Internet Communication Manager 7.85', 'SAP Internet Communication Manager 7.86']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-28773",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-28773"
    }
  },
  "description": "SAP Web dispatcher\u548cSAP Internet Communication Manager\uff08SAP ICM\uff09\u90fd\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002SAP Web dispatcher\u662fLoad Balancing \u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u652f\u6301\u8d1f\u8f7d\u5747\u8861\uff0c\u63d0\u4f9b\u53cd\u5411\u4ee3\u7406\u7684\u529f\u80fd\uff0c\u4f7f\u5f97\u5916\u7f51\u7528\u6237\u53ef\u4ee5\u8bbf\u95ee\u5230\u5185\u90e8\u5e94\u7528\u3002SAP Internet Communication Manager\u662f\u4e00\u4e2aSAP NetWeaver\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u7684\u7ec4\u4ef6\u3002\u7528\u4e8e\u63a5\u6536\u548c\u53d1\u9001Web\u8bf7\u6c42\uff08HTTP\u3001HTTPS\u3001SMTP\uff09\u3002\n\nSAP Web Dispatcher\u548cSAP Internet Communication Manager\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9012\u5f52\u672a\u53d7\u63a7\u5236\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7a0b\u5e8f\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://launchpad.support.sap.com/#/notes/3111293",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-41301",
  "openTime": "2022-05-27",
  "patchDescription": "SAP Web dispatcher\u548cSAP Internet Communication Manager\uff08SAP ICM\uff09\u90fd\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002SAP Web dispatcher\u662fLoad Balancing \u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u652f\u6301\u8d1f\u8f7d\u5747\u8861\uff0c\u63d0\u4f9b\u53cd\u5411\u4ee3\u7406\u7684\u529f\u80fd\uff0c\u4f7f\u5f97\u5916\u7f51\u7528\u6237\u53ef\u4ee5\u8bbf\u95ee\u5230\u5185\u90e8\u5e94\u7528\u3002SAP Internet Communication Manager\u662f\u4e00\u4e2aSAP NetWeaver\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u7684\u7ec4\u4ef6\u3002\u7528\u4e8e\u63a5\u6536\u548c\u53d1\u9001Web\u8bf7\u6c42\uff08HTTP\u3001HTTPS\u3001SMTP\uff09\u3002\r\n\r\nSAP Web Dispatcher\u548cSAP Internet Communication Manager\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9012\u5f52\u672a\u53d7\u63a7\u5236\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7a0b\u5e8f\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Web Dispatcher\u548cInternet Communication Manager\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP Internet Communication Manager 7.22EXT",
      "SAP Internet Communication Manager 7.49",
      "SAP Internet Communication Manager 7.53",
      "SAP Internet Communication Manager 7.77",
      "SAP Internet Communication Manager 7.81",
      "SAP Web Dispatcher 7.53",
      "SAP Web Dispatcher 7.77",
      "SAP Web Dispatcher 7.81",
      "SAP Web Dispatcher 7.85",
      "SAP Web Dispatcher 7.86",
      "SAP Internet Communication Manager KRNL64NUC 7.22",
      "SAP Internet Communication Manager KRNL64UC 7.22",
      "SAP Internet Communication Manager KERNEL 7.22",
      "SAP Internet Communication Manager 7.85",
      "SAP Internet Communication Manager 7.86"
    ]
  },
  "referenceLink": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
  "serverity": "\u4e2d",
  "submitTime": "2022-04-15",
  "title": "SAP Web Dispatcher\u548cInternet Communication Manager\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2022-28773 (GCVE-0-2022-28773)

Vulnerability from cvelistv5

Published

2022-04-12 16:11

Modified

2024-08-03 06:03

Severity ?

CWE

CWE-674 - Uncontrolled Recursion

Summary

Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.

References

▼	URL	Tags
	https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3111293	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

SAP SE

SAP NetWeaver (Internet Communication Manager)

Version: KRNL64NUC 7.22
Version: 7.22EXT
Version: 7.49
Version: KRNL64UC 7.22
Version: 7.53
Version: KERNEL 7.22
Version: 7.77
Version: 7.81
Version: 7.85
Version: 7.86

SAP SE

SAP Web Dispatcher

Version: 7.53
Version: 7.77
Version: 7.81
Version: 7.85
Version: 7.86

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:03:52.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3111293"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver (Internet Communication Manager)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.86"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAP Web Dispatcher",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.86"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDue to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.\u003c/p\u003e"
            }
          ],
          "value": "Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-14T13:01:01.412Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3111293"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-28773",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver (Internet Communication Manager)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "KRNL64NUC 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22EXT"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "KRNL64UC 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22EXT"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "KERNEL 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.77"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.81"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.85"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.86"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP Web Dispatcher",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.77"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.81"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.85"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.86"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-789"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3111293",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3111293"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-28773",
    "datePublished": "2022-04-12T16:11:30",
    "dateReserved": "2022-04-06T00:00:00",
    "dateUpdated": "2024-08-03T06:03:52.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted