CVE-2022-31590 Privilege escalation in SAP PowerDesigner Proxy 16.7
Local attackers can write files to the system root path to execute code with elevated privileges during application startup or reboot.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31590?
CVE-2022-31590 is a high-severity vulnerability in SAP PowerDesigner Proxy 16.7, published on 14 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the application during application start up or reboot, potentially compromising Confidentiality, Integrity and Availability of the system.
Weakness: CWE-428
Which versions are affected by CVE-2022-31590?
It affects 1 product.
Products include Sap Powerdesigner Proxy.
How do I fix CVE-2022-31590?
No fix has been published for CVE-2022-31590 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-31590 being exploited?
There is no known exploitation of CVE-2022-31590 in the wild and no public exploit code.
Other vulnerabilities in SAP PowerDesigner Proxy 16.7
Sources
Also known as GHSA-2qxv-q349-j3hw.