CVE-2022-29614: sap se sap netweaver as abap, as java, abap platform and hana database Improper Privilege Management

Vulnerability summary

CVE-2022-29614 is a medium (CVSS 5.0) Improper Privilege Management vulnerability in sap se sap netweaver as abap, as java, abap platform and hana database. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 14-06-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, SAPHOSTAGENT 7.22, - on Unix systems, s-bit helper program sapuxuserchk, can be abused physically resulting in a privilege escalation of an attacker leading to low impact on confidentiality and integrity, but a profound impact on availability.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.