CVE-2022-39013

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
SAP SE	SAP BusinessObjects Business Intelligence Platform (Program Objects)	420; 430

References

https://launchpad.support.sap.com/#/notes/3229132Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3229132Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Oct 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390145.3Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attack CVE-2022-390156.5Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted.CVE-2022-390168.8Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a craf CVE-2022-390175.4Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to CVE-2022-390187.5Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files v CVE-2022-390197.5Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files CVE-2022-39026.4An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5 CVE-2022-390206.1Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, CVE-2022-390216.1U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vulnerability to redir CVE-2022-390226.5U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab CVE-2022-390236.5U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab CVE-2022-390246.1U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vuln