CVE-2022-22545 Information disclosure in SAP NetWeaver Application Server ABAP and ABAP Platform
High-privileged users can read sensitive HTTP connection details in SAP NetWeaver ABAP, exposing configuration data to authorized personnel.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22545?
CVE-2022-22545 is a medium-severity vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform, published on 9 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application Server ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756.
Weakness: CWE-200
Which versions are affected by CVE-2022-22545?
It affects 1 product.
Products include Sap Netweaver Abap.
How do I fix CVE-2022-22545?
No fix has been published for CVE-2022-22545 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-22545 being exploited?
There is no known exploitation of CVE-2022-22545 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2012-4341 Memory corruption in n/a
- CVE-2021-27610 Auth bypass in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-38178 Business logic in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2022-22543 Denial of service in SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)
- CVE-2021-38181 Denial of service in SAP NetWeaver AS ABAP and ABAP Platform
Sources
Also known as GHSA-fmqh-553p-23mc.