Vulnerability · Published Jan 14, 2022 · Assigned by sap
CVE-2022-22531
High 8.1
In plain English
A high-severity security flaw in SAP S/4HANA from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.8%top 41.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP S/4HANA | 100101102103104105106 |
References
- https://launchpad.support.sap.com/#/notes/3112928 x_refsource_MISC
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035 x_refsource_MISC