Vulnerability · Published Dec 13, 2022 · Assigned by sap

CVE-2022-41268

High 8.5

In plain English

A high-severity privilege mismanagement in Business Planning and Consolidation from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.6%top 50.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such transaction code, a malicious user may execute unauthorized transaction functionality. Under specific circumstances, a successful attack could enable an adversary to escalate their privileges to be able to read, change or delete system data.

Affected products (as reported)

Vendor	Product	Versions
SAP	Business Planning and Consolidation	SAP_BW 750 – through SAP_BW 757DWCORE 200 – through DWCORE 300CPMBPC 810

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References