CVE-2022-22531
Published Jan 14, 2022
Last updated a year ago
Overview
- Description
- The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified.
- Source
- cna@sap.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.1
- Impact score
- 5.2
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5.5
- Impact score
- 4.9
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:N
Weaknesses
- nvd@nist.gov
- NVD-CWE-noinfo
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11051D6A-FC81-4951-ACDA-BB07D5A5D751"
},
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:101:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6FE144C-BAF2-4E45-93EE-D70764BDEFD6"
},
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:102:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55BACB30-A607-410E-AB05-E991CC19CE12"
},
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:103:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95A0C742-4CBD-46B8-B2B3-5949EFC82A6D"
},
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:104:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14A540DA-F234-4EEA-ADE8-4F6306A86C1E"
},
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:105:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "088EF501-76F9-44EC-B8B9-AED6F6096C03"
},
{
"criteria": "cpe:2.3:a:sap:s\\/4hana:106:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0023602-B509-4B20-9B29-20EEE88E1692"
}
],
"operator": "OR"
}
]
}
]