Riskcovery

CVE-2022-41268

State
Published
Severity
8.5 High
Published
Dec 13, 2022
Updated
Apr 22, 2025
Reserved
Sep 21, 2022

Read the record on cve.org

Description

In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such transaction code, a malicious user may execute unauthorized transaction functionality. Under specific circumstances, a successful attack could enable an adversary to escalate their privileges to be able to read, change or delete system data.

Scores

CVSSScoreVectorSource
3.18.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsap

Weaknesses

  • CWE-269 Improper Privilege Management

Affected Products

ProductVersions
Business Planning and ConsolidationSAP
  • SAP_BW 750 through SAP_BW 757Affected
  • DWCORE 200 through DWCORE 300Affected
  • CPMBPC 810Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.