SAP NetWeaver Process Integration up to 7.50 JNDI missing authentication

Summaryinfo

A vulnerability was found in SAP NetWeaver Process Integration up to 7.50. It has been declared as critical. This issue affects some unknown processing of the component JNDI Handler. The manipulation results in missing authentication. This vulnerability is known as CVE-2022-41272. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in SAP NetWeaver Process Integration up to 7.50 (Solution Stack Software). It has been classified as critical. Affected is some unknown processing of the component JNDI Handler. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.

The weakness was published 12/13/2022. The advisory is shared for download at launchpad.support.sap.com. This vulnerability is traded as CVE-2022-41272 since 09/21/2022. There are neither technical details nor an exploit publicly available.

Applying a patch is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Solution Stack Software

Vendor

• SAP

Name

• NetWeaver Process Integration

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21
• 7.22
• 7.23
• 7.24
• 7.25
• 7.26
• 7.27
• 7.28
• 7.29
• 7.30
• 7.31
• 7.32
• 7.33
• 7.34
• 7.35
• 7.36
• 7.37
• 7.38
• 7.39
• 7.40
• 7.41
• 7.42
• 7.43
• 7.44
• 7.45
• 7.46
• 7.47
• 7.48
• 7.49
• 7.50

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion