Medium severity · published Oct 11, 2022
CVE-2022-41209
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well
5.2
CVSS
0.2%
EPSS
No
On KEV
Description
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SAP Customer Data Cloud (Gigya) · SAP SE
7.4 · source: vendor
CD
Customer Data Cloud · Sap
7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41209
Permissions Required
https://launchpad.support.sap.com/#/notes/3248970
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP Customer Data Cloud (Gigya)
5.2
CVE-2022-41210
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to predict future random…