CVE-2022-41267 - Server-Side Request Forgery vulnerability in SAP BusinessObjects Business Intelligence Platform: An attacker with normal BI user privileges can upload/replace any file on Business Objects server, which enables to take full control of the system.

The impact on the Confidentiality, Integrity, and Availability of the application is HIGH.

CVE-2022-41272 - Improper access control in SAP NetWeaver Process Integration (User Defined Search): An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services, which can be used to perform unauthorized operations affecting users and data across the entire system.

The impact on Confidentiality is HIGH. The impact on Availability and Integrity of the application is LIMITED.

CVE-2022-42889 - Remote Code Execution vulnerability associated with Apache Commons Text in SAP Commerce: Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation.

In versions 1.5 through 1.9, the set of default Lookup instances included interpolators that could result in Remote Code Execution on the affected servers. These lookups are:

• "script" (execute expressions using the JVM script execution engine),
• "dns" (resolve dns records),
• "url" (load values from urls).

CVE-2022-41271 - Improper access control in SAP NetWeaver Process Integration (Messaging System): An unauthenticated attacker can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. The attacker can use an open naming and directory API to access services that could perform unauthorized operations.

These operations can be used to:

• Read any information
• Modify sensitive information
• Conduct Denial of Service (DoS) attacks
• SQL Injection

The impact on Confidentiality and Availability is HIGH. The impact on Integrity is LIMITED.