CVE-2022-22528: 
SAP Adaptive Server Enterprise vulnerability analysis and mitigation

SAP Adaptive Server Enterprise (ASE) version 16.0 contains a vulnerability related to the installation process on Windows platforms. The vulnerability (CVE-2022-22528) was disclosed in February 2022 and affects the ASE installer's handling of system PATH environment variables. This vulnerability allows a standard user to potentially execute malicious Windows binaries, leading to privilege escalation on the local system. Importantly, the issue is specific to the ASE installer and does not impact other ASE binaries (NVD).

The vulnerability is classified as an Uncontrolled Search Path Element (CWE-427) issue. It received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability specifically relates to how the ASE installer manages entries in the Windows system PATH environment variable, which under certain conditions can be exploited by a standard user (NVD).

The vulnerability can lead to privilege escalation on the local system when exploited successfully. An attacker with standard user privileges could potentially execute malicious Windows binaries, gaining elevated access to the system. This could result in unauthorized access to sensitive system resources and potential system compromise (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit under the right conditions. No user interaction is required for exploitation (NVD).

SAP has released security patches to address this vulnerability. Users should refer to SAP Security Note 3140564 for detailed mitigation instructions (SAP Advisory).