A vulnerability, which was classified as problematic, has been found in SAP NetWeaver Application Server ABAP (Application Server Software) (version unknown). This issue affects an unknown function. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. The summary by CVE is:

Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integrity and availability of the application.

The weakness was published 11/09/2022. The advisory is shared at launchpad.support.sap.com. The identification of this vulnerability is CVE-2022-41214 since 09/21/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Applying a patch is able to eliminate this problem.

Similar entry is available at VDB-213184.

Productinfo

Type

• Application Server Software

Vendor

• SAP

Name

• NetWeaver Application Server ABAP

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion