CVE-2022-35291
Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)
- State
- Published
- Severity
- 8.1 High
- Published
- Jul 27, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jul 7, 2022
Description
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | sap |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
SAP SuccessFactors Mobile Application for Android & iOS devicesSAP SuccessFactors |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.