PT-2022-17674 · Sap · Sap Financial Consolidation

Published 2022-03-08 · Updated 2022-03-18 · CVE-2022-26104

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Financial Consolidation version 10.1

Description The issue is related to the lack of necessary authorization checks for updating homepage messages. This allows an unauthorized user to alter the maintenance system message.

Recommendations For SAP Financial Consolidation version 10.1, consider restricting access to the homepage message update functionality until a proper authorization check is implemented to prevent unauthorized alterations. As a temporary workaround, limit the ability of unauthorized users to modify the maintenance system message. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-26104

Affected Products

Sap Financial Consolidation

References · 5

• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26104 · Security Note
• https://launchpad.support.sap.com/#/notes/3144941 · Vendor Advisory
• https://t.me/cibsecurity/38720 · Telegram Post