CVE-2022-41214

Summary

CVE	CVE-2022-41214
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-11-08 22:15:00 UTC
Updated	2023-11-07 03:52:00 UTC
Description	Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integrity and availability of the application.

Risk And Classification

Problem Types: CWE-20

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Sap	Netweaver Application Server Abap	700	All	All	All
Application	Sap	Netweaver Application Server Abap	731	All	All	All
Application	Sap	Netweaver Application Server Abap	740	All	All	All
Application	Sap	Netweaver Application Server Abap	750	All	All	All
Application	Sap	Netweaver Application Server Abap	789	All	All	All
Application	Sap	Netweaver Application Server Abap	804	All	All	All

References

Reference	Source	Link	Tags
Access Denied	MISC	www.sap.com
launchpad.support.sap.com	MISC	launchpad.support.sap.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

87526 SAP NetWeaver AS ABAP and ABAP Platform Security Update (3256571)