SAP BASIS
En bref
- Source
- NVD
- EPSS
- EPSS 0.92 % · centile 60 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Rechercher sur…
Description
Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application.
Faiblesses (CWE)
- CWE-94 — Injection de code
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | sap |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-44473
- GCVE · GCVE-0-2022-41264
Avis du CERT-FR
- CERTFR-2023-AVI-0125 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2022-AVI-1101 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:basis:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.40:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.50:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.51:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.52:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.53:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.54:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.55:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.56:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.57:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.89:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.90:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.91:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP · BASIS | affected 731 ; affected 740 ; affected 750 ; affected 751 ; affected 752 ; affected 753 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |