github - ghsa-vhrf-gfcg-4676

ghsa-vhrf-gfcg-4676

Vulnerability from github

Published

2022-06-15 00:00

Modified

2022-06-28 00:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-31589"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-14T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.",
  "id": "GHSA-vhrf-gfcg-4676",
  "modified": "2022-06-28T00:00:54Z",
  "published": "2022-06-15T00:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31589"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3203065"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2022-31589

Vulnerability from cvelistv5

Published

2022-06-14 18:36

Modified

2024-08-03 07:19

Severity ?

Summary

References

▼	URL	Tags
	https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3203065	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

SAP SE

SAP ERP, localization for CEE countries.

Version: C-CEE 110_600
Version: 110_602
Version: 110_603
Version: 110_604
Version: 110_700

	SAP SE	SAP Financials	Version: SAP_FIN 618 Version: 720
	SAP SE	SAP S/4Hana Core	Version: S4CORE 100 Version: 101 Version: 102 Version: 103 Version: 104 Version: 105 Version: 106 Version: 107 Version: 108

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:19:06.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3203065"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP ERP, localization for CEE countries.",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "C-CEE 110_600"
            },
            {
              "status": "affected",
              "version": "110_602"
            },
            {
              "status": "affected",
              "version": "110_603"
            },
            {
              "status": "affected",
              "version": "110_604"
            },
            {
              "status": "affected",
              "version": "110_700"
            }
          ]
        },
        {
          "product": "SAP Financials",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_FIN 618"
            },
            {
              "status": "affected",
              "version": "720"
            }
          ]
        },
        {
          "product": "SAP S/4Hana Core",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 100"
            },
            {
              "status": "affected",
              "version": "101"
            },
            {
              "status": "affected",
              "version": "102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-14T18:36:39",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3203065"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-31589",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP ERP, localization for CEE countries.",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "C-CEE 110_600"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "110_602"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "110_603"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "110_604"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "110_700"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP Financials",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "SAP_FIN 618"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "720"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP S/4Hana Core",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "S4CORE 100"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "101"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "102"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "103"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "104"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "105"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "106"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "107"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "108"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-863"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3203065",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3203065"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-31589",
    "datePublished": "2022-06-14T18:36:39",
    "dateReserved": "2022-05-24T00:00:00",
    "dateUpdated": "2024-08-03T07:19:06.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted