Lucene search

SapCVELIST:CVE-2022-35291

HistoryJul 27, 2022 - 1:30 p.m.

CVE-2022-35291 Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)

2022-07-2713:30:02

CWE-269

sap

www.cve.org

cve-2022-35291

sap successfactors

privilege escalation

mobile application

android

ios

misconfigured endpoints

attackers

user privileges

admin privileges

network

sf mobile application

time off

time sheet

ec workflow

benefits

confidentiality

integrity

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application

CNA Affected

[
  {
    "product": "SAP SuccessFactors Mobile Application for Android & iOS devices",
    "vendor": "SAP SuccessFactors",
    "versions": [
      {
        "lessThan": "V8.0.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3226411

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Related for CVELIST:CVE-2022-35291