CVE-2022-22535

SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3126489	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:erp_human_capital_management:600::::portugal:::
	cpe:2.3:a:sap:erp_human_capital_management:604::::portugal:::
	cpe:2.3:a:sap:erp_human_capital_management:608::::portugal:::

History

No history.

Information

Published : 2022-02-09 23:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-22535

Mitre link : CVE-2022-22535

CVE.ORG link : CVE-2022-22535

JSON object : View

Products Affected

sap

erp_human_capital_management

CWE

CWE-862

Missing Authorization

{"id": "CVE-2022-22535", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-02-09T23:15:18.573", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3126489", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts."}, {"lang": "es", "value": "SAP ERP HCM Portugal - versiones 600, 604, 608, no lleva a cabo las comprobaciones de autorizaci\u00f3n necesarias para un informe que lee los datos de la n\u00f3mina de los empleados de una determinada \u00e1rea. Como el informe afectado s\u00f3lo lee la informaci\u00f3n de la n\u00f3mina, el atacante no puede modificar ninguna informaci\u00f3n ni causar impactos en la disponibilidad"}], "lastModified": "2022-10-27T01:10:59.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:erp_human_capital_management:600:*:*:*:portugal:*:*:*", "vulnerable": true, "matchCriteriaId": "C80ACC56-A755-4491-A9FF-D8A806EE4F33"}, {"criteria": "cpe:2.3:a:sap:erp_human_capital_management:604:*:*:*:portugal:*:*:*", "vulnerable": true, "matchCriteriaId": "FD6309CF-9A86-4F35-A29B-C7ACE2051126"}, {"criteria": "cpe:2.3:a:sap:erp_human_capital_management:608:*:*:*:portugal:*:*:*", "vulnerable": true, "matchCriteriaId": "1479D860-4064-438D-AC48-90E67B2C41C7"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}