{"api_version":"1","generated_at":"2026-07-23T19:45:41+00:00","cve":"CVE-2022-22538","urls":{"html":"https://cve.report/CVE-2022-22538","api":"https://cve.report/api/cve/CVE-2022-22538.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-22538","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-22538"},"summary":{"title":"CVE-2022-22538","description":"When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2022-02-09 23:15:00","updated_at":"2022-10-26 15:23:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022","name":"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022","refsource":"MISC","tags":[],"title":"SAP Security Patch Day - February 2022 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","name":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","refsource":"MISC","tags":[],"title":"Access Denied","mime":"text/html","httpstatus":"403","archivestatus":"429"},{"url":"https://launchpad.support.sap.com/#/notes/3134684","name":"https://launchpad.support.sap.com/#/notes/3134684","refsource":"MISC","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22538","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22538","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"22538","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"3d_visual_enterprise_viewer","cpe6":"9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2022-22538","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP 3D Visual Enterprise Viewer","version":{"version_data":[{"version_affected":"=","version_value":"9.0"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below."}]},"impact":{"cvss":{"baseScore":"null","vectorString":"null","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-20"}]}]},"references":{"reference_data":[{"url":"https://launchpad.support.sap.com/#/notes/3134684","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/3134684"},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","refsource":"MISC","name":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}]}},"nvd":{"publishedDate":"2022-02-09 23:15:00","lastModifiedDate":"2022-10-26 15:23:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:3d_visual_enterprise_viewer:9:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"22538","Ordinal":"224888","Title":"CVE-2022-22538","CVE":"CVE-2022-22538","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"22538","Ordinal":"1","NoteData":"When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below.","Type":"Description","Title":null},{"CveYear":"2022","CveId":"22538","Ordinal":"2","NoteData":"2022-02-09","Type":"Other","Title":"Published"},{"CveYear":"2022","CveId":"22538","Ordinal":"3","NoteData":"2022-02-09","Type":"Other","Title":"Modified"}]}}}