CVE-2022-41268

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-41268
In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such transaction code, a malicious user may execute unauthorized transaction functionality. Under specific circumstances, a successful attack could enable an adversary to escalate their privileges to be able to read, change or delete system data.

8.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://launchpad.support.sap.com/#/notes/3271091 Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
https://launchpad.support.sap.com/#/notes/3271091 Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:business_planning_and_consolidation:200:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:300:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:756:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:757:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_planning_and_consolidation:810:*:*:*:*:*:*:*
History

21 Nov 2024, 07:22

Type Values Removed Values Added
Summary
  • (es) En algunos roles estándar de SAP en SAP Business Planning and Consolidation - versiones - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, se utiliza un código de transacción reservado para el cliente. Al implementar dicho código de transacción, un usuario malintencionado puede ejecutar una funcionalidad de transacción no autorizada. En circunstancias específicas, un ataque exitoso podría permitir a un adversario aumentar sus privilegios para poder leer, cambiar o eliminar datos del sistema.
References () https://launchpad.support.sap.com/#/notes/3271091 - Permissions Required, Vendor Advisory () https://launchpad.support.sap.com/#/notes/3271091 - Permissions Required, Vendor Advisory
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 8.5
Information

Published : 2022-12-13 03:15

Updated : 2024-11-21 07:22

NVD link : CVE-2022-41268

Mitre link : CVE-2022-41268

CVE.ORG link : CVE-2022-41268

JSON object : View

Products Affected

sap

  • business_planning_and_consolidation
CWE
CWE-269

Improper Privilege Management