CVE-2022-22530
Vulnerability from cvelistv5
Published
2022-01-14 19:11
Modified
2024-08-03 03:14
Severity ?
Summary
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/3112928Permissions Required
cna@sap.comhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/3112928Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:14:55.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3112928"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP S/4HANA",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "100"
            },
            {
              "status": "affected",
              "version": "101"
            },
            {
              "status": "affected",
              "version": "102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application.\u003c/p\u003e"
            }
          ],
          "value": "The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Code Injection",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-10T18:08:30.733Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3112928"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-22530",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP S/4HANA",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "100"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "101"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "102"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "103"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "104"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "105"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "106"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Code Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://launchpad.support.sap.com/#/notes/3112928",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3112928"
            },
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-22530",
    "datePublished": "2022-01-14T19:11:26",
    "dateReserved": "2022-01-04T00:00:00",
    "dateUpdated": "2024-08-03T03:14:55.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:100:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11051D6A-FC81-4951-ACDA-BB07D5A5D751\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:101:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E6FE144C-BAF2-4E45-93EE-D70764BDEFD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:102:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"55BACB30-A607-410E-AB05-E991CC19CE12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:103:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"95A0C742-4CBD-46B8-B2B3-5949EFC82A6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:104:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"14A540DA-F234-4EEA-ADE8-4F6306A86C1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:105:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"088EF501-76F9-44EC-B8B9-AED6F6096C03\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:106:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0023602-B509-4B20-9B29-20EEE88E1692\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"La aplicaci\\u00f3n F0743 Create Single Payment de SAP S/4HANA - versiones 100, 101, 102, 103, 104, 105, 106, no comprueba los archivos cargados o descargados. Esto permite a un atacante con derechos de usuario b\\u00e1sicos inyectar contenido peligroso o c\\u00f3digo malicioso que podr\\u00eda resultar en una modificaci\\u00f3n de informaci\\u00f3n cr\\u00edtica o comprometer completamente la disponibilidad de la aplicaci\\u00f3n\"}]",
      "id": "CVE-2022-22530",
      "lastModified": "2024-11-21T06:46:58.020",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.2}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:N/I:P/A:C\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.0, \"impactScore\": 7.8, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-01-14T20:15:15.837",
      "references": "[{\"url\": \"https://launchpad.support.sap.com/#/notes/3112928\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/3112928\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cna@sap.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-22530\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2022-01-14T20:15:15.837\",\"lastModified\":\"2024-11-21T06:46:58.020\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application.\\n\\n\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n F0743 Create Single Payment de SAP S/4HANA - versiones 100, 101, 102, 103, 104, 105, 106, no comprueba los archivos cargados o descargados. Esto permite a un atacante con derechos de usuario b\u00e1sicos inyectar contenido peligroso o c\u00f3digo malicioso que podr\u00eda resultar en una modificaci\u00f3n de informaci\u00f3n cr\u00edtica o comprometer completamente la disponibilidad de la aplicaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:C\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":7.8,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:100:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11051D6A-FC81-4951-ACDA-BB07D5A5D751\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:101:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6FE144C-BAF2-4E45-93EE-D70764BDEFD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:102:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55BACB30-A607-410E-AB05-E991CC19CE12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95A0C742-4CBD-46B8-B2B3-5949EFC82A6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:104:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14A540DA-F234-4EEA-ADE8-4F6306A86C1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:105:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"088EF501-76F9-44EC-B8B9-AED6F6096C03\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:106:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0023602-B509-4B20-9B29-20EEE88E1692\"}]}]}],\"references\":[{\"url\":\"https://launchpad.support.sap.com/#/notes/3112928\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3112928\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.