PT-2022-4654 · Sap · Sap Enterprise Extension Defense Forces & Public Security

Published 2022-05-24 · Updated 2022-07-16 · CVE-2022-31592

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP Enterprise Extension Defense Forces & Public Security versions 605 through 806

Description The issue is related to authorization errors in the software. It does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges. This can lead to a limited impact on confidentiality. Exploitation of the issue may allow a remote attacker to elevate their privileges.

Recommendations For versions 605 through 806, apply the necessary authorization checks to prevent escalation of privileges. As a temporary workaround, consider restricting network access to authenticated users until a proper fix is implemented.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-05538

CVE-2022-31592

Affected Products

Sap Enterprise Extension Defense Forces & Public Security

References · 6

• https://bdu.fstec.ru/vul/2022-05538 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3196280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31592 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31592 · Vendor Advisory
• https://vuldb.com/ru/?id.203764 · Note