CVE-2022-29612: 
Sap Host Agent vulnerability analysis and mitigation

CVE-2022-29612 affects SAP NetWeaver, ABAP Platform and SAP Host Agent across multiple versions including KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, 8.04, and SAPHOSTAGENT 7.22. The vulnerability was disclosed in June 2022 and involves the misuse of sapcontrol web functionality (startservice) in the Kernel (NVD).

The vulnerability allows an authenticated user to misuse a function of sapcontrol web functionality (startservice) in the Kernel. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and no user interaction (NVD).

Upon successful exploitation, an attacker can obtain restricted technical information such as system numbers or physical addresses. The vulnerability has a limited impact on the confidentiality of the application, with no direct impact on integrity or availability (NVD).

SAP has released security notes and patches to address this vulnerability. Users should refer to SAP Security Note 3194674 for detailed mitigation instructions (SAP Note).