Auth bypass in Sap Netweaver_as_abap
CVE-2022-27668
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77…
Vulnerability class: Broken Access Control
EPSS: 0.020 (78.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap Netweaver_as_abap — versions kernel_7.49, kernel_7.77, kernel_7.81
- Sap Netweaver_as_abap_krnl64nuc — versions 7.49
- Sap Netweaver_as_abap_krnl64uc — versions 7.49
- Sap Router — versions 7.22, 7.53
- Sap Se Netweaver And Abap Platform — versions KERNEL 7.49, 7.77, 7.81
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
- cna@sap.com (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- cna@sap.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-27668?
- CVE-2022-27668 is a critical-severity vulnerability in Sap Netweaver_as_abap, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2022-06-14.
- How severe is CVE-2022-27668?
- Critical severity. CVSS v3 base score is 9.8 out of 10.