nvd-json-data-feeds/CVE-2022/CVE-2022-412xx/CVE-2022-41264.json

{
  "id": "CVE-2022-41264",
  "sourceIdentifier": "cna@sap.com",
  "published": "2022-12-13T03:15:09.330",
  "lastModified": "2022-12-15T16:14:22.063",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "cna@sap.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "cna@sap.com",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AC2D764-A795-4FBC-95AF-D212B8E51991"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "B469CB1A-3AF3-4824-A185-A46A63DBABBE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.50:*:*:*:*:*:*:*",
              "matchCriteriaId": "56852389-A9A8-42DB-A471-10C1990502FF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.51:*:*:*:*:*:*:*",
              "matchCriteriaId": "594CB284-78FF-491F-BAF6-390E7D4D5DBE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.52:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7ACA030-9C6A-47D3-A7D9-899753870241"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.53:*:*:*:*:*:*:*",
              "matchCriteriaId": "893979E3-40EB-4847-A39B-F548F3000F89"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.54:*:*:*:*:*:*:*",
              "matchCriteriaId": "977F2126-AB92-47D0-B7D4-314D468AC497"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.55:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE7ABA91-2E83-4135-B543-C4BC04E67BA1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.56:*:*:*:*:*:*:*",
              "matchCriteriaId": "7881EFCE-EA98-4513-BBE2-B1728D3EBE61"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.57:*:*:*:*:*:*:*",
              "matchCriteriaId": "E924B0F0-B319-4B8A-8436-4A9E4657D5AB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.89:*:*:*:*:*:*:*",
              "matchCriteriaId": "400C963C-15B3-45DC-BF72-1AD59099DB87"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.90:*:*:*:*:*:*:*",
              "matchCriteriaId": "E13804DE-69D3-4F43-BC97-5BE7D79854E5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:basis:7.91:*:*:*:*:*:*:*",
              "matchCriteriaId": "9076C5C4-CE37-4D6D-B271-DB41166C1337"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3268172",
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}