CVE-2022-28771

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-287727.5By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.CVE-2022-287737.5Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial CVE-2022-287745.5Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.CVE-2022-287753.3Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permi CVE-2022-287767.8Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store wi CVE-2022-287773.3Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without C CVE-2022-287783.3Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as CVE-2022-287797.8Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attack CVE-2022-287805.5Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that CVE-2022-287816.7Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. T CVE-2022-287824.6Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package befo CVE-2022-287837.1Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packag