CVE-2022-41209

MediumCVSS 5.2/10Last modified Jun 17, 2026

Description

SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
SAP SE	SAP Customer Data Cloud (Gigya)	7.4

References

https://launchpad.support.sap.com/#/notes/3248970Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3248970Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Oct 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-41215.5In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to CVE-2022-412105.2SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for CVE-2022-412117.8Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Au CVE-2022-412124.9Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges CVE-2022-412148.7Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges CVE-2022-412154.7SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL CVE-2022-412166.5Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system.CVE-2022-412179.8Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLO CVE-2022-412185.5In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_de CVE-2022-41225.3A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in informatio CVE-2022-412209.8md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE: the vendor's positio CVE-2022-412217.1The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Adm