Medium severity · published Oct 11, 2022
CVE-2022-41210
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to predict future random…
5.2
CVSS
0.4%
EPSS
No
On KEV
Description
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to predict future random numbers. This can lead to information disclosure and modification of certain user settings.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SAP Customer Data Cloud (Gigya) · SAP SE
7.4 · source: vendor
CD
Customer Data Cloud · Sap
7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41210
Permissions Required
https://launchpad.support.sap.com/#/notes/3248384
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP Customer Data Cloud (Gigya)
5.2
CVE-2022-41209
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well