A note with CVSS 5.5 for component BC-FES-GUI was released by SAP on 08.11.2022. The correction/advisory 3237251 was described with "[CVE-2022-41205] Code injection vulnerability in SAP GUI for Windows" and affects the system type SAP GUI.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is code injection within SAP GUI.
Risk specificationSAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to the system registries.
SAP GUI has been updated and will no longer execute scripts in the local network
The advisory is valid for
- 9.9 [CVE-2022-41203] Insecure Deserialization of Untrusted Data in SAP BusinessObjects Business Intelligence Platform (Central Management Console and BI Launchpad)
- 9.9 [CVE-2021-27602] Remote Code Execution vulnerability in Source Rules of SAP Commerce
- 9.9 [CVE-2021-21466] Code Injection in SAP Business Warehouse and SAP BW/4HANA
- 9.1 [CVE-2020-26838] Code Injection vulnerability in SAP Business Warehouse (Master Data Management) and SAP BW4HANA
- 9.1 [CVE-2020-6318] Code Injection vulnerability in SAP NetWeaver (ABAP Server) and ABAP Platform