CVE-2022-35292: sap_se sap business one Unquoted Search Path or Element

Vulnerability summary

CVE-2022-35292 is a high (CVSS 7.8) Unquoted Search Path or Element vulnerability in sap_se sap business one. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.8% of scored vulnerabilities.

Timeline

1. 13-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.