6.5

CVE-2022-31589

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Erp Financial Accounting Version 618
SAP ≫ Erp Financial Accounting Version 720
SAP ≫ Erp Localization For Cee Countries Version c-cee_110_600
SAP ≫ Erp Localization For Cee Countries Version c-cee_110_602
SAP ≫ Erp Localization For Cee Countries Version c-cee_110_603
SAP ≫ Erp Localization For Cee Countries Version c-cee_110_604
SAP ≫ Erp Localization For Cee Countries Version c-cee_110_700
SAP ≫ S/4HANA Version 100
SAP ≫ S/4HANA Version 101
SAP ≫ S/4HANA Version 102
SAP ≫ S/4HANA Version 103
SAP ≫ S/4HANA Version 104
SAP ≫ S/4HANA Version 105
SAP ≫ S/4HANA Version 106
SAP ≫ S/4HANA Version 107
SAP ≫ S/4HANA Version 108
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.471
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory
https://launchpad.support.sap.com/#/notes/3203065
Vendor Advisory
Permissions Required