PT-2022-3931 · Sap · Sap Successfactors Mobile+1

Published 2022-07-12 · Updated 2022-08-02 · CVE-2022-35291

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP SuccessFactors (affected versions not specified)

Description The issue is related to misconfigured application endpoints in SAP SuccessFactors attachment APIs, allowing attackers with user privileges to perform activities with admin privileges over the network. These APIs are used in the SF Mobile application for various modules, including Time Off, Time Sheet, EC Workflow, and Benefits. Successful exploitation can lead to an attacker being able to read and write attachments, compromising the confidentiality and integrity of the application. The vulnerability is also associated with inadequate access control in the implementation of these modules in the SAP SuccessFactors Mobile platform for Android and iOS operating systems, which can allow a remote attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-04760

CVE-2022-35291

Affected Products

Sap Successfactors

Sap Successfactors Mobile

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-35291 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04760 · Security Note
• https://launchpad.support.sap.com/#/notes/3226411 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35291 · Vendor Advisory
• https://t.me/cibsecurity/47077 · Telegram Post