CVE-2022-31597 (GCVE-0-2022-31597)

Vulnerability from cvelistv5 – Published: 2022-07-12 20:27 – Updated: 2024-08-03 07:25
VLAI
Summary
Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.
Severity
No CVSS data available.
CWE
Assigner
sap
References
Impacted products
Vendor Product Version
SAP SE SAP S/4HANA Affected: S4CORE 101
Affected: 102
Affected: 103
Affected: 104
Affected: 105
Affected: 106
Affected: SAPSCORE 127
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:25:59.513Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3213826"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP S/4HANA",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 101"
            },
            {
              "status": "affected",
              "version": "102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "SAPSCORE 127"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-12T20:27:00.000Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3213826"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-31597",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP S/4HANA",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "S4CORE 101"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "102"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "103"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "104"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "105"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "106"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "SAPSCORE 127"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3213826",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3213826"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-31597",
    "datePublished": "2022-07-12T20:27:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:25:59.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-31597",
      "date": "2026-05-27",
      "epss": "0.00144",
      "percentile": "0.34309"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:101:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E6FE144C-BAF2-4E45-93EE-D70764BDEFD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:102:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"55BACB30-A607-410E-AB05-E991CC19CE12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:103:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"95A0C742-4CBD-46B8-B2B3-5949EFC82A6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:104:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"14A540DA-F234-4EEA-ADE8-4F6306A86C1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:105:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"088EF501-76F9-44EC-B8B9-AED6F6096C03\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:s\\\\/4hana:106:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0023602-B509-4B20-9B29-20EEE88E1692\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sapscore:127:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B2FC5C8-4459-4D5F-B06F-EF52D20AD451\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.\"}, {\"lang\": \"es\", \"value\": \"Dentro de SAP S/4HANA - versiones S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE versi\\u00f3n 127, la extensi\\u00f3n de la aplicaci\\u00f3n de socios comerciales para Espa\\u00f1a/Eslovaquia no lleva a cabo las comprobaciones de autorizaci\\u00f3n necesarias para un usuario autenticado con pocos privilegios a trav\\u00e9s de la red, resultando en una escalada de privilegios que presenta un impacto bajo en la confidencialidad e integridad de los datos\"}]",
      "id": "CVE-2022-31597",
      "lastModified": "2024-11-21T07:04:49.053",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.5}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:N\", \"baseScore\": 5.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-07-12T21:15:10.143",
      "references": "[{\"url\": \"https://launchpad.support.sap.com/#/notes/3213826\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/3213826\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cna@sap.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cna@sap.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-31597\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2022-07-12T21:15:10.143\",\"lastModified\":\"2024-11-21T07:04:49.053\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.\"},{\"lang\":\"es\",\"value\":\"Dentro de SAP S/4HANA - versiones S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE versi\u00f3n 127, la extensi\u00f3n de la aplicaci\u00f3n de socios comerciales para Espa\u00f1a/Eslovaquia no lleva a cabo las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado con pocos privilegios a trav\u00e9s de la red, resultando en una escalada de privilegios que presenta un impacto bajo en la confidencialidad e integridad de los datos\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:N\",\"baseScore\":5.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:101:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6FE144C-BAF2-4E45-93EE-D70764BDEFD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:102:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55BACB30-A607-410E-AB05-E991CC19CE12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95A0C742-4CBD-46B8-B2B3-5949EFC82A6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:104:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14A540DA-F234-4EEA-ADE8-4F6306A86C1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:105:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"088EF501-76F9-44EC-B8B9-AED6F6096C03\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s\\\\/4hana:106:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0023602-B509-4B20-9B29-20EEE88E1692\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sapscore:127:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B2FC5C8-4459-4D5F-B06F-EF52D20AD451\"}]}]}],\"references\":[{\"url\":\"https://launchpad.support.sap.com/#/notes/3213826\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3213826\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.