CVE-2022-41259: SQL Injection
SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use an ARRAY constructor.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-41259?
CVE-2022-41259 is a vulnerability in SAP SQL Anywhere version 17.0 that allows an authenticated attacker to crash the server with certain queries, preventing legitimate users from accessing the database server.
How severe is CVE-2022-41259?
CVE-2022-41259 has a severity rating of 6.5, which is considered medium.
How does CVE-2022-41259 affect SAP SQL Anywhere?
CVE-2022-41259 affects SAP SQL Anywhere version 17.0, allowing an authenticated attacker to crash the server by using certain queries.
How can an attacker exploit CVE-2022-41259?
An attacker can exploit CVE-2022-41259 by using certain queries that use an ARRAY constructor to crash the SAP SQL Anywhere server.
Is there a fix for CVE-2022-41259?
Yes, SAP has released a fix for CVE-2022-41259. You can refer to the SAP Security Note 3229987 for more information on how to apply the fix.