GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2022-31589

Vulnerability from fkie_nvd - Published: 2022-06-14 19:15 - Updated: 2026-06-17 04:45
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/3203065Permissions Required, Vendor Advisory
cna@sap.comhttps://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/3203065Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
Impacted products
Vendor Product Version
sap erp_financial_accounting 618
sap erp_financial_accounting 720
sap erp_localization_for_cee_countries c-cee_110_600
sap erp_localization_for_cee_countries c-cee_110_602
sap erp_localization_for_cee_countries c-cee_110_603
sap erp_localization_for_cee_countries c-cee_110_604
sap erp_localization_for_cee_countries c-cee_110_700
sap s\/4hana 100
sap s\/4hana 101
sap s\/4hana 102
sap s\/4hana 103
sap s\/4hana 104
sap s\/4hana 105
sap s\/4hana 106
sap s\/4hana 107
sap s\/4hana 108
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "SAP ERP, localization for CEE countries.",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "C-CEE 110_600"
            },
            {
              "status": "affected",
              "version": "110_602"
            },
            {
              "status": "affected",
              "version": "110_603"
            },
            {
              "status": "affected",
              "version": "110_604"
            },
            {
              "status": "affected",
              "version": "110_700"
            }
          ]
        },
        {
          "product": "SAP Financials",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_FIN 618"
            },
            {
              "status": "affected",
              "version": "720"
            }
          ]
        },
        {
          "product": "SAP S/4Hana Core",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 100"
            },
            {
              "status": "affected",
              "version": "101"
            },
            {
              "status": "affected",
              "version": "102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:erp_financial_accounting:618:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3C2AF1E-8905-4039-8376-3BB81F2E0245",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_financial_accounting:720:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9F9A4B4-B1CC-462D-9A04-328C067CBEE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_600:*:*:*:*:*:*:*",
              "matchCriteriaId": "07FC15D7-4AEA-4883-9216-2D4D8D36AEF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_602:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6D5C4AE-59FC-4280-BA9A-FF66169FFA22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_603:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7FD2CF2-2F21-45EC-87DD-BED8618C4A5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_604:*:*:*:*:*:*:*",
              "matchCriteriaId": "682AF52C-FA0F-4846-B9FB-76EAC1FEE6CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_700:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B786732-8AD0-4EF4-B756-51697177868F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:100:*:*:*:*:*:*:*",
              "matchCriteriaId": "11051D6A-FC81-4951-ACDA-BB07D5A5D751",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:101:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6FE144C-BAF2-4E45-93EE-D70764BDEFD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:102:*:*:*:*:*:*:*",
              "matchCriteriaId": "55BACB30-A607-410E-AB05-E991CC19CE12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:103:*:*:*:*:*:*:*",
              "matchCriteriaId": "95A0C742-4CBD-46B8-B2B3-5949EFC82A6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:104:*:*:*:*:*:*:*",
              "matchCriteriaId": "14A540DA-F234-4EEA-ADE8-4F6306A86C1E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:105:*:*:*:*:*:*:*",
              "matchCriteriaId": "088EF501-76F9-44EC-B8B9-AED6F6096C03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:106:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0023602-B509-4B20-9B29-20EEE88E1692",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:107:*:*:*:*:*:*:*",
              "matchCriteriaId": "489A03BA-B2B1-4271-9A0B-B514051807DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:108:*:*:*:*:*:*:*",
              "matchCriteriaId": "527C39A2-8777-4334-B4D4-A738442A0FB9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted."
    },
    {
      "lang": "es",
      "value": "Debido a una comprobaci\u00f3n inapropiada de la autorizaci\u00f3n, a los usuarios de la empresa usando el programa Israeli File from SHAAM (transacci\u00f3n /ATL/VQ23), les es concedida m\u00e1s autorizaci\u00f3n de la necesaria para llevar a cabo determinadas transacciones, lo que puede conllevar a que usuarios tengan acceso a datos que de otro modo estar\u00edan restringidos"
    }
  ],
  "id": "CVE-2022-31589",
  "lastModified": "2026-06-17T04:45:44.357",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-06-14T19:15:07.623",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3203065"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3203065"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.