Vulnerability · Published Feb 9, 2022 · Assigned by sap
CVE-2022-22528
High 7.8
In plain English
A high-severity uncontrolled search path in SAP Adaptive Server Enterprise from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 75.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certain conditions, allows a Standard User to execute malicious Windows binaries which may lead to privilege escalation on the local system. The issue is with the ASE installer and does not impact other ASE binaries.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Adaptive Server Enterprise | 16.0 |
Weakness: CWE-427
References
- https://launchpad.support.sap.com/#/notes/3140564 x_refsource_MISC
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC