Vulnerability · Published Jun 14, 2022 · Assigned by sap

CVE-2022-27668

Critical 9.8

In plain English

A critical-severity incorrect authorization in SAP NetWeaver and ABAP Platform from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.2%top 17.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP NetWeaver and ABAP Platform	KERNEL 7.497.777.817.857.867.877.88KRNL64NUC 7.49

Weakness: CWE-863

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3158375 x_refsource_MISC
20220915 SEC Consult SA-20220914-0 :: Improper Access Control in SAP SAProuter mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html x_refsource_MISC