« Volver al listado

CVE-2022-39802

Estado: ModificadaAlta (7.5)—

SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Manufacturing Execution

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39802",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Manufacturing Execution",
          "versions": [
            {
              "status": "affected",
              "version": "15.1"
            },
            {
              "status": "affected",
              "version": "15.2"
            },
            {
              "status": "affected",
              "version": "15.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-11T21:15:14.833",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/168716/SAP-Manufacturing-Execution-Core-15.3-Path-Traversal.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3242933",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/168716/SAP-Manufacturing-Execution-Core-15.3-Path-Traversal.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3242933",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure."
    },
    {
      "lang": "es",
      "value": "SAP Manufacturing Execution - versiones 15.1, 15.2, 15.3, permite a un atacante explotar una comprobación insuficiente de un parámetro de petición de ruta de archivo. La ruta de archivo prevista puede ser manipulada para permitir un recorrido arbitrario de directorios en el servidor remoto. El contenido de los archivos dentro de cada directorio puede ser leído, lo que puede conllevar a una divulgación de información"
    }
  ],
  "lastModified": "2026-06-17T04:58:20.220",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:manufacturing_execution:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23297FB8-B4A8-4E84-80EE-67907C249A70"
            },
            {
              "criteria": "cpe:2.3:a:sap:manufacturing_execution:15.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87614D9A-544B-42FE-9C58-5389E3716240"
            },
            {
              "criteria": "cpe:2.3:a:sap:manufacturing_execution:15.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7FC9087-C677-4AD0-8A06-93FC19E06409"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}