CVE Vulnerabilities

CVE-2022-28773

Uncontrolled Recursion

Published: Apr 12, 2022 | Modified: Aug 14, 2023
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Netweaver Sap 7.22ext (including) 7.22ext (including)
Netweaver Sap 7.49 (including) 7.49 (including)
Netweaver Sap 7.53 (including) 7.53 (including)
Netweaver Sap 7.77 (including) 7.77 (including)
Netweaver Sap 7.81 (including) 7.81 (including)
Netweaver Sap 7.85 (including) 7.85 (including)
Netweaver Sap 7.86 (including) 7.86 (including)
Netweaver Sap kernel_7.22 (including) kernel_7.22 (including)
Netweaver Sap krnl64nuc_7.22 (including) krnl64nuc_7.22 (including)
Netweaver Sap krnl64uc_7.22 (including) krnl64uc_7.22 (including)
Web_dispatcher Sap 7.53 (including) 7.53 (including)
Web_dispatcher Sap 7.77 (including) 7.77 (including)
Web_dispatcher Sap 7.81 (including) 7.81 (including)
Web_dispatcher Sap 7.85 (including) 7.85 (including)
Web_dispatcher Sap 7.86 (including) 7.86 (including)

Potential Mitigations

References