PT-2022-15501 · Sap · Sap S/4Hana

Published 2022-01-14 · Updated 2026-02-24 · CVE-2022-22531

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP S/4HANA versions 100 through 106

Description The issue concerns the F0743 Create Single Payment application, which fails to check uploaded or downloaded files. This oversight allows an attacker with basic user rights to execute arbitrary script code, potentially leading to the disclosure or modification of sensitive information.

Recommendations For SAP S/4HANA versions 100 through 106, consider implementing additional file validation and sanitization measures to prevent the execution of arbitrary script code. As a temporary workaround, restrict access to the F0743 Create Single Payment application to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2022-22531

Affected Products

Sap S/4Hana

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22531 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22531 · Vendor Advisory
• https://t.me/cvenotify/53992 · Telegram Post
• https://t.me/cveNotify/153059 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3112928 · Note