CVE-2022-22543 (GCVE-0-2022-22543)
Vulnerability from cvelistv5
Published
2022-02-09 22:05
Modified
2024-08-03 03:14
Severity ?
CWE
Summary
SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected.
References
Impacted products
Vendor Product Version
SAP SE SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) Version: KERNEL 7.22
Version: 8.04
Version: 7.49
Version: 7.53
Version: 7.77
Version: 7.81
Version: 7.85
Version: 7.86
Version: 7.87
Version: KRNL64UC 8.04
Version: 7.22
Version: 7.22EXT
Version: KRNL64NUC 7.22
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:14:55.768Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3116223"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.86"
            },
            {
              "status": "affected",
              "version": "7.87"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 8.04"
            },
            {
              "status": "affected",
              "version": "7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-24T15:19:34",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3116223"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-22543",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "KERNEL 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.04"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.77"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.81"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.85"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.86"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.87"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "KRNL64UC 8.04"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22EXT"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "KRNL64NUC 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22EXT"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://launchpad.support.sap.com/#/notes/3116223",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3116223"
            },
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-22543",
    "datePublished": "2022-02-09T22:05:27",
    "dateReserved": "2022-01-04T00:00:00",
    "dateUpdated": "2024-08-03T03:14:55.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-22543\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2022-02-09T23:15:18.913\",\"lastModified\":\"2024-11-21T06:46:59.687\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected.\"},{\"lang\":\"es\",\"value\":\"SAP NetWeaver Application Server for ABAP (Kernel) y ABAP Platform (Kernel) - versiones KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, no comprueba suficientemente la informaci\u00f3n de sap-passport, lo que podr\u00eda conllevar un ataque de Denegaci\u00f3n de Servicio. Esto permite a un usuario remoto no autorizado provocar un bloqueo del proceso de trabajo del SAP Web Dispatcher o del Kernel. El proceso colapsado puede reiniciarse inmediatamente, los dem\u00e1s procesos no est\u00e1n afectados\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFBA8C16-AD2E-4046-A22D-B8AB2A38DAD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.22ext:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A701B328-CC8D-4F10-8CDB-47883CAAC116\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.49:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"699E6EA8-1AA9-4C0E-A373-7E2F93E2F861\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A748DC7-E701-4E5B-9918-5CA6D7F52899\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.77:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E438D5E-F211-4361-AC2D-E86A7CE88026\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.81:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87B7FA96-2BA0-4328-8C97-31129E72D779\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.85:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BD5DBA8-4181-41C4-86B2-02615CACA6C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.86:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA794E5E-8C20-4B3A-BF1C-6F9A127F19D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:7.87:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1812ED28-5F27-4E43-88B5-55D0E37B4426\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:8.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D271FC7-E8B0-4323-9254-9AB9FCE08544\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE1BE43A-6659-4C08-8194-F85FA47D7D81\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_abap:krnl64nuc_8.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B72A96D-9567-4A63-B336-A4FF44E55809\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5F6938B-667A-43C2-AF0E-42CD67B378B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.22ext:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46CD1D25-308E-474A-8837-55A363FD2159\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.49:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C4499C-FADC-4B8F-8FD6-489D040FC566\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CCEC8BE-F106-475F-BFCF-1D2EFB05DECB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.77:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9756558-70CB-44A8-B1D4-496426B9A820\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.81:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"370C6CD1-94C0-4639-8B63-01755B702F4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.85:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23AE7B69-8A79-4C2E-9C0A-52594F324E57\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.86:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"312D8ECD-195D-44C2-B040-C4D8BD088CC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:7.87:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5719E2B-20F7-4FD7-B51E-87CC76FD94FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:8.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F14E0EB-94CD-445C-BE80-97A27B11C3FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6A8D9F8-B501-450D-9632-320FBA5DFBAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_8.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2253203D-1B9E-4AFA-957E-EFF819502B35\"}]}]}],\"references\":[{\"url\":\"https://launchpad.support.sap.com/#/notes/3116223\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3116223\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.