Sign-up

ID

VAR-202211-0884


CVE

CVE-2022-41205


TITLE

SAP  of  SAP GUI  Code injection vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-020542

DESCRIPTION

SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application. SAP of SAP GUI There is a code injection vulnerability in.Information is obtained and service operation is interrupted (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2022-41205 // JVNDB: JVNDB-2022-020542

AFFECTED PRODUCTS

vendor:sapmodel:guiscope:eqversion:7.70

Trust: 1.8

vendor:sapmodel:guiscope: - version: -

Trust: 0.8

vendor:sapmodel:guiscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-020542 // NVD: CVE-2022-41205

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-41205
value: MEDIUM

Trust: 1.0

cna@sap.com: CVE-2022-41205
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-41205
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202211-2363
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-41205
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 4.2
version: 3.1

Trust: 1.0

cna@sap.com: CVE-2022-41205
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 4.7
version: 3.1

Trust: 1.0

NVD: CVE-2022-41205
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-020542 // CNNVD: CNNVD-202211-2363 // NVD: CVE-2022-41205 // NVD: CVE-2022-41205

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.0

problemtype:Code injection (CWE-94) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-020542 // NVD: CVE-2022-41205

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202211-2363

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-202211-2363

PATCH

title:SAP GUI Fixes for code injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=213771

Trust: 0.6

sources: CNNVD: CNNVD-202211-2363

EXTERNAL IDS

db:NVDid:CVE-2022-41205

Trust: 3.2

db:JVNDBid:JVNDB-2022-020542

Trust: 0.8

db:CNNVDid:CNNVD-202211-2363

Trust: 0.6

sources: JVNDB: JVNDB-2022-020542 // CNNVD: CNNVD-202211-2363 // NVD: CVE-2022-41205

REFERENCES

url:https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Trust: 2.4

url:https://launchpad.support.sap.com/#/notes/3237251

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-41205

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-41205/

Trust: 0.6

url:https://vigilance.fr/vulnerability/sap-multiple-vulnerabilities-de-decembre-2021-39865

Trust: 0.6

sources: JVNDB: JVNDB-2022-020542 // CNNVD: CNNVD-202211-2363 // NVD: CVE-2022-41205

SOURCES

db:JVNDBid:JVNDB-2022-020542
db:CNNVDid:CNNVD-202211-2363
db:NVDid:CVE-2022-41205

LAST UPDATE DATE

2024-08-14T13:52:54.942000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2022-020542date:2023-11-02T08:03:00
db:CNNVDid:CNNVD-202211-2363date:2022-11-10T00:00:00
db:NVDid:CVE-2022-41205date:2023-11-07T03:52:43.860

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2022-020542date:2023-11-02T00:00:00
db:CNNVDid:CNNVD-202211-2363date:2022-11-08T00:00:00
db:NVDid:CVE-2022-41205date:2022-11-08T22:15:17.657