SAP Security Patch Day, December 2022: the CVEs

SAP Security Patch Day December 2022: the CVEs SAP published on 13 December 2022, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Nov 2022, Oct 2022, Sep 2022, Aug 2022, Jul 2022, Jun 2022, May 2022, Apr 2022, Mar 2022, Feb 2022, Jan 2022, Dec 2021. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 6.1CVE-2022-41275EPSS 0.5%2022-12-13

   In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can be redirected to a malicious page that could read or modify sensitive informatio…

2. 6.5CVE-2022-41274EPSS 0.6%2022-12-13

   SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can…

3. 6.1CVE-2022-41273EPSS 0.5%2022-12-13

   Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim wit…

4. 8.6CVE-2022-41272EPSS 1.1%2022-12-13

   An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to…

5. 9.4CVE-2022-41271EPSS 0.6%2022-12-13

   An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services th…

6. 7.5CVE-2022-41268EPSS 0.6%2022-12-13

   In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such trans…

7. 8.8CVE-2022-41267EPSS 0.9%2022-12-13

   SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the…

8. 6.1CVE-2022-41266EPSS 0.4%2022-12-13

   Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site …

9. 8.8CVE-2022-41264EPSS 0.9%2022-12-13

   Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of …