CVE-2022-31597: SAP SE SAP S/4HANA, заобикаляне на вход и права

Описание

Оригинално описание

Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.

Засегнати продукти

• SAP SE SAP S/4HANA: S4CORE 101; 102; 103; 104; 105; 106; SAPSCORE 127

Вид слабост

• CWE-862 Missing Authorization

История

Други уязвимости в SAP SE SAP S/4HANA

• CVE-2022-32248
• CVE-2022-22531
• CVE-2022-22530
• 9.1CVE-2021-33701
• 9.9CVE-2021-38176

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-31597
• https://nvd.nist.gov/vuln/detail/CVE-2022-31597
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
• https://launchpad.support.sap.com/#/notes/3213826