CVE-2022-31589 - OpenCVE

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Sap	Erp Financial Accounting S\/4hana Erp Localization For Cee Countries

Configuration 1 [-]

OR	cpe:2.3:a:sap:erp_financial_accounting:618:::::::*
	cpe:2.3:a:sap:erp_financial_accounting:720:::::::*
	cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_600:::::::*
	cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_602:::::::*
	cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_603:::::::*
	cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_604:::::::*
	cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_700:::::::*
	cpe:2.3:a:sap:s\/4hana:100:::::::*
	cpe:2.3:a:sap:s\/4hana:101:::::::*
	cpe:2.3:a:sap:s\/4hana:102:::::::*
	cpe:2.3:a:sap:s\/4hana:103:::::::*
	cpe:2.3:a:sap:s\/4hana:104:::::::*
	cpe:2.3:a:sap:s\/4hana:105:::::::*
	cpe:2.3:a:sap:s\/4hana:106:::::::*
	cpe:2.3:a:sap:s\/4hana:107:::::::*
	cpe:2.3:a:sap:s\/4hana:108:::::::*

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3203065	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: sap

Published: 2022-06-14T18:36:39

Updated: 2022-06-14T18:36:39

Reserved: 2022-05-24T00:00:00

Link: CVE-2022-31589

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-06-14T19:15:07.623

Modified: 2023-06-29T14:29:23.823

Link: CVE-2022-31589

JSON object: View

Redhat Information

No data.

CWE

{"containers": {"cna": {"affected": [{"product": "SAP ERP, localization for CEE countries.", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "C-CEE 110_600"}, {"status": "affected", "version": "110_602"}, {"status": "affected", "version": "110_603"}, {"status": "affected", "version": "110_604"}, {"status": "affected", "version": "110_700"}]}, {"product": "SAP Financials", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "SAP_FIN 618"}, {"status": "affected", "version": "720"}]}, {"product": "SAP S/4Hana Core", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "S4CORE 100"}, {"status": "affected", "version": "101"}, {"status": "affected", "version": "102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}]}], "descriptions": [{"lang": "en", "value": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-14T18:36:39", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/3203065"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2022-31589", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP ERP, localization for CEE countries.", "version": {"version_data": [{"version_affected": "=", "version_value": "C-CEE 110_600"}, {"version_affected": "=", "version_value": "110_602"}, {"version_affected": "=", "version_value": "110_603"}, {"version_affected": "=", "version_value": "110_604"}, {"version_affected": "=", "version_value": "110_700"}]}}, {"product_name": "SAP Financials", "version": {"version_data": [{"version_affected": "=", "version_value": "SAP_FIN 618"}, {"version_affected": "=", "version_value": "720"}]}}, {"product_name": "SAP S/4Hana Core", "version": {"version_data": [{"version_affected": "=", "version_value": "S4CORE 100"}, {"version_affected": "=", "version_value": "101"}, {"version_affected": "=", "version_value": "102"}, {"version_affected": "=", "version_value": "103"}, {"version_affected": "=", "version_value": "104"}, {"version_affected": "=", "version_value": "105"}, {"version_affected": "=", "version_value": "106"}, {"version_affected": "=", "version_value": "107"}, {"version_affected": "=", "version_value": "108"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted."}]}, "impact": {"cvss": {"baseScore": "null", "vectorString": "null", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-863"}]}]}, "references": {"reference_data": [{"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "refsource": "MISC", "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"name": "https://launchpad.support.sap.com/#/notes/3203065", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/3203065"}]}}}}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2022-31589", "datePublished": "2022-06-14T18:36:39", "dateReserved": "2022-05-24T00:00:00", "dateUpdated": "2022-06-14T18:36:39", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:erp_financial_accounting:618:*:*:*:*:*:*:*", "matchCriteriaId": "B3C2AF1E-8905-4039-8376-3BB81F2E0245", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp_financial_accounting:720:*:*:*:*:*:*:*", "matchCriteriaId": "D9F9A4B4-B1CC-462D-9A04-328C067CBEE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_600:*:*:*:*:*:*:*", "matchCriteriaId": "07FC15D7-4AEA-4883-9216-2D4D8D36AEF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_602:*:*:*:*:*:*:*", "matchCriteriaId": "F6D5C4AE-59FC-4280-BA9A-FF66169FFA22", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_603:*:*:*:*:*:*:*", "matchCriteriaId": "B7FD2CF2-2F21-45EC-87DD-BED8618C4A5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_604:*:*:*:*:*:*:*", "matchCriteriaId": "682AF52C-FA0F-4846-B9FB-76EAC1FEE6CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_700:*:*:*:*:*:*:*", "matchCriteriaId": "5B786732-8AD0-4EF4-B756-51697177868F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:100:*:*:*:*:*:*:*", "matchCriteriaId": "11051D6A-FC81-4951-ACDA-BB07D5A5D751", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:101:*:*:*:*:*:*:*", "matchCriteriaId": "E6FE144C-BAF2-4E45-93EE-D70764BDEFD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:102:*:*:*:*:*:*:*", "matchCriteriaId": "55BACB30-A607-410E-AB05-E991CC19CE12", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:103:*:*:*:*:*:*:*", "matchCriteriaId": "95A0C742-4CBD-46B8-B2B3-5949EFC82A6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:104:*:*:*:*:*:*:*", "matchCriteriaId": "14A540DA-F234-4EEA-ADE8-4F6306A86C1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:105:*:*:*:*:*:*:*", "matchCriteriaId": "088EF501-76F9-44EC-B8B9-AED6F6096C03", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:106:*:*:*:*:*:*:*", "matchCriteriaId": "E0023602-B509-4B20-9B29-20EEE88E1692", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:107:*:*:*:*:*:*:*", "matchCriteriaId": "489A03BA-B2B1-4271-9A0B-B514051807DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:108:*:*:*:*:*:*:*", "matchCriteriaId": "527C39A2-8777-4334-B4D4-A738442A0FB9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted."}, {"lang": "es", "value": "Debido a una comprobaci\u00f3n inapropiada de la autorizaci\u00f3n, a los usuarios de la empresa usando el programa Israeli File from SHAAM (transacci\u00f3n /ATL/VQ23), les es concedida m\u00e1s autorizaci\u00f3n de la necesaria para llevar a cabo determinadas transacciones, lo que puede conllevar a que usuarios tengan acceso a datos que de otro modo estar\u00edan restringidos"}], "id": "CVE-2022-31589", "lastModified": "2023-06-29T14:29:23.823", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-14T19:15:07.623", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/3203065"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "cna@sap.com", "type": "Secondary"}]}