Skip to main content

Adaptive Server Enterprise CVE-2022-31594

MEDIUM
Improper Privilege Management (CWE-269)
2022-06-14 cna@sap.com
Privilege Escalation Adaptive Server Enterprise
6.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 14, 2022 - 19:15 nvd
MEDIUM 6.7

DescriptionNVD

A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system.

AnalysisAI

A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system. Affected products include: Sap Adaptive Server Enterprise.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Adaptive Server Enterprise

View all
CVE-2013-6245 CRITICAL
10.0 Oct 24

Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. Rated critical severity

CVE-2014-6284 HIGH POC
7.5 Jun 08

SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the c
CVE-2014-6283 MEDIUM POC
6.5 Oct 17

SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not

CVE-2016-7402 CRITICAL
9.8 Nov 03

SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges

CVE-2013-6025 MEDIUM POC
4.0 Oct 19

The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to re
CVE-2013-6865 CRITICAL
9.0 Nov 23

SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7
CVE-2013-6866 CRITICAL
9.0 Nov 23

SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 o
CVE-2013-6863 CRITICAL
9.0 Nov 23

SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7
CVE-2022-31595 HIGH
8.8 Jun 14

SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, r
CVE-2020-6243 HIGH
8.8 May 12

Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not

CVE-2020-6241 HIGH
8.8 May 12

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevat
CVE-2013-6859 HIGH
8.5 Nov 23

SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. Rated high severity (CVSS 8.5), this vulnerability is

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2016-0151 HIGH POC
7.8
CVE-2013-0643 HIGH
8.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2022-31594 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy