CVE-2022-41264

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790,…

High8.8EPSS 0.92%

Published: 13 Dec 2022
Updated: 22 Apr 2025
Reserved: 21 Sept 2022
Assigned by: sap

Description

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application.

Scores

CVSS scores of CVE-2022-41264, by who scored it
Scored by	CVSS	Score	Vector
sapCNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.92% · top 40% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

SAP · BASIS
- affected 731
- affected 740
- affected 750
- affected 751
- affected 752
- affected 753
- affected 754
- affected 755
- affected 756
- affected 757
- affected 789
- affected 790
- affected 791

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-41264](https://trackcve.app/badge/CVE-2022-41264.svg)](https://trackcve.app/cve/CVE-2022-41264)

Record last updated 22 Apr 2025, 14:24 UTC.