PT-2022-20863 · Shaam · Shaam

Published 2022-06-14 · Updated 2023-06-29 · CVE-2022-31589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SHAAM program (affected versions not specified)

Description The issue is related to an improper authorization check, which grants business users more than needed authorization to perform certain transactions when using the Israeli File from the SHAAM program, specifically through the /ATL/VQ23 transaction "API Endpoint". This may lead to users accessing data that would otherwise be restricted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-31589

Affected Products

Shaam

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31589 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31589 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3203065 · Vendor Advisory
• https://t.me/cibsecurity/44447 · Telegram Post