Vulnerability · Published Jun 14, 2022 · Assigned by sap
CVE-2022-31589
Medium 6.5
In plain English
A medium-severity incorrect authorization in SAP ERP, localization for CEE countries. from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP ERP, localization for CEE countries. | C-CEE 110_600110_602110_603110_604110_700 |
| SAP SE | SAP Financials | SAP_FIN 618720 |
| SAP SE | SAP S/4Hana Core | S4CORE 100101102103104105106107 |
Weakness: CWE-863
References
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3203065 x_refsource_MISC