CVE-2022-22545: Infoleak

Published Feb 9, 2022

Updated

A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application Server ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756.

Affected Software

15 affected components

SAP NetWeaver ABAP=700

SAP NetWeaver ABAP=701

SAP NetWeaver ABAP=702

SAP NetWeaver ABAP=710

SAP NetWeaver ABAP=711

SAP NetWeaver ABAP=730

SAP NetWeaver ABAP=731

SAP NetWeaver ABAP=740

SAP NetWeaver ABAP=750

SAP NetWeaver ABAP=751

SAP NetWeaver ABAP=752

SAP NetWeaver ABAP=753

SAP NetWeaver ABAP=754

SAP NetWeaver ABAP=755

SAP NetWeaver ABAP=756

Event History

Feb 9, 2022

CVE Published

via MITRE·10:05 PM

Data Sourced

via MITRE·10:05 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-22545.

What is the severity of CVE-2022-22545?

The severity of CVE-2022-22545 is medium with a severity value of 4.9.

Which software versions are affected by CVE-2022-22545?

SAP NetWeaver Application Server ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, and 756 are affected by CVE-2022-22545.

How can a high privileged user exploit CVE-2022-22545?

A high privileged user can exploit CVE-2022-22545 by accessing transaction SM59 and reading connection details stored with the destination for HTTP calls.

Are there any fixes available for CVE-2022-22545?

Yes, SAP has provided fixes for CVE-2022-22545. Refer to the SAP notes for more information.