CVE-2022-26102

Katalog CVE

CVSS 5.4 · Medium EPSS 0,49%

Kerentanan Missing Authorization pada sap netweaver application server abap. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application.

Rincian

Terbit di NVD

10 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 advisory vendor
• https://launchpad.support.sap.com/#/notes/3145997 permissions required · advisory vendor