CVE-2022-31589

2022-06-1418:36:39

CWE-863

sap

www.cve.org

improper authorization

israeli file

shaam program

data access

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.

CNA Affected

[
  {
    "product": "SAP ERP, localization for CEE countries.",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "C-CEE 110_600"
      },
      {
        "status": "affected",
        "version": "110_602"
      },
      {
        "status": "affected",
        "version": "110_603"
      },
      {
        "status": "affected",
        "version": "110_604"
      },
      {
        "status": "affected",
        "version": "110_700"
      }
    ]
  },
  {
    "product": "SAP Financials",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "SAP_FIN 618"
      },
      {
        "status": "affected",
        "version": "720"
      }
    ]
  },
  {
    "product": "SAP S/4Hana Core",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "S4CORE 100"
      },
      {
        "status": "affected",
        "version": "101"
      },
      {
        "status": "affected",
        "version": "102"
      },
      {
        "status": "affected",
        "version": "103"
      },
      {
        "status": "affected",
        "version": "104"
      },
      {
        "status": "affected",
        "version": "105"
      },
      {
        "status": "affected",
        "version": "106"
      },
      {
        "status": "affected",
        "version": "107"
      },
      {
        "status": "affected",
        "version": "108"
      }
    ]
  }
]