Advisory
A note with CVSS 4.9 for component BC-CST-WDP was released by SAP on 12.04.2022. The correction/advisory 3111293 was described with "[CVE-2022-28773] Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)" and affects the system type Kernel.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is denial of service (dos) within Kernel.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash and become temporarily unavailable but can be restarted automatically.Solution
The affected code has been updated to prevent the denial of service vulnerability Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Disable the administration UI.".
The advisory is valid for
- HDB 2.00 7
- KERNEL 7.22 15
- KERNEL 7.49 21
- KERNEL 7.53 22
- KERNEL 7.77 21
- KERNEL 7.81 20
- KERNEL 7.85 13
- KERNEL 7.86 10
- KRNL64NUC 7.22 20
- KRNL64NUC 7.22EXT 20
- KRNL64NUC 7.49 22
- KRNL64UC 7.22 20
- KRNL64UC 7.22EXT 20
- KRNL64UC 7.49 22
- KRNL64UC 7.53 21
- WEBDISP 7.53 8
- WEBDISP 7.77 8
- WEBDISP 7.81 7
- WEBDISP 7.85 4
- WEBDISP 7.86 3
- 7.5 Denial of service (DOS) in SAP Commerce
- 7.5 [CVE-2022-28772]Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)
- 7.5 [CVE-2020-6196] Denial of service (DOS) in SAP BusinessObjects Mobile (MobileBIService)
- 7.5 [CVE-2020-6186] Denial of Service (DOS) Vulnerability in SAP Host Agent
- 7.5 [CVE-2021-33670] Denial of Service (DoS) in SAP NetWeaver AS for Java (Http Service)