What is CVE-2022-22540?

CVE-2022-22540 is a high-severity vulnerability in SAP Netweaver Application Server Abap, classified under SQL Injection. CVSS score: 7.5/10. Published 2022-02-09.

How severe is CVE-2022-22540?

High severity. CVSS v3 base score is 7.5 out of 10.

SQL Injection in SAP Netweaver Application Server Abap

CVE-2022-22540

SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database. Successful attacks could result in disclosure of a table of contents from the system, but no risk of modification possible.

Vulnerability class: SQL Injection

EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Sap Netweaver_application_server_abap — versions 700, 701, 702
Sap Se Netweaver As Abap (Workplace Server) — versions 700, 701, 702

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
cna@sap.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-22540?: CVE-2022-22540 is a high-severity vulnerability in SAP Netweaver Application Server Abap, classified under SQL Injection. CVSS score: 7.5/10. Published 2022-02-09.
How severe is CVE-2022-22540?: High severity. CVSS v3 base score is 7.5 out of 10.