Riskcovery

CVE-2022-41271

State
Published
Severity
9.4 Critical
Published
Dec 13, 2022
Updated
Apr 22, 2025
Reserved
Sep 21, 2022

Read the record on cve.org

Description

An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services that could perform unauthorized operations. The vulnerability affects local users and data, leading to a considerable impact on confidentiality as well as availability and a limited impact on the integrity of the application. These operations can be used to:

* Read any information * Modify sensitive information * Denial of Service attacks (DoS) * SQL Injection

Scores

CVSSScoreVectorSource
3.19.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Hsap

Weaknesses

  • CWE-862 Missing Authorization
  • CWE-306 Missing Authentication for Critical Function
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
NetWeaver Process IntegrationSAP
  • 7.50Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.