CVE-2022-41271 SQL injection in NetWeaver Process Integration

Critical 9.4 Published 13 Dec 2022 Updated 22 Apr 2025

Unauthenticated attackers can exploit JNDI interfaces to read, modify data, or cause denial of service via SQL injection in SAP NetWeaver PI.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-41271?

CVE-2022-41271 is a critical SQL injection vulnerability in SAP NetWeaver Process Integration, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services that could perform unauthorized operations. The vulnerability affects local users and data, leading to a considerable impact on confidentiality as well as availability and a limited impact on the integrity of the application. These operations can be used to:

* Read any information * Modify sensitive information * Denial of Service attacks (DoS) * SQL Injection

Weakness: CWE-89, CWE-862, CWE-306

Which versions are affected by CVE-2022-41271?

It affects 1 product.

Products include Sap Netweaver Process Integration.

How do I fix CVE-2022-41271?

No fix has been published for CVE-2022-41271 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-41271 being exploited?

There is no known exploitation of CVE-2022-41271 in the wild and no public exploit code.

Sources

Also known as GHSA-h4qc-785v-gj2p.