SAP GUI vulnerabilities

3 CVEs affecting SAP GUI, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-41205, published 2022-11-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-2282, published 2015-06-02. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver…
CVE-2015-2278, published 2015-06-02. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver…
CVE-2022-41205, published 2022-11-08. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on…