SAP SE SAP Manufacturing Execution
At a glance
- Source
- NVD
- EPSS
- EPSS 9.29 % · percentile 95 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-42247
- GCVE · GCVE-0-2022-39802
CERT-FR advisories
- CERTFR-2022-AVI-904 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:manufacturing_execution:15.1:*:*:*:*:*:*:*cpe:2.3:a:sap:manufacturing_execution:15.2:*:*:*:*:*:*:*cpe:2.3:a:sap:manufacturing_execution:15.3:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP SE · SAP Manufacturing Execution | affected 15.1 ; affected 15.2 ; affected 15.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |