Vulnerability · Published Jun 14, 2022 · Assigned by sap

CVE-2022-29612

Medium 4.3

In plain English

A medium-severity server-side request forgery in SAP NetWeaver, ABAP Platform and SAP Host Agent from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.7%top 47.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, 8.04, SAPHOSTAGENT 7.22, allows an authenticated user to misuse a function of sapcontrol webfunctionality(startservice) in Kernel which enables malicious users to retrieve information. On successful exploitation, an attacker can obtain technical information like system number or physical address, which is otherwise restricted, causing a limited impact on the confidentiality of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP NetWeaver, ABAP Platform and SAP Host Agent	KERNEL 7.227.497.537.777.817.857.867.87

Weakness: CWE-918

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3194674 x_refsource_MISC