CVE-2022-22542: Infoleak

Published Feb 9, 2022

Updated

S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.

Affected Software

3 affected components

SAP S\/4hana=104

SAP S\/4hana=105

SAP S\/4hana=106

Event History

Feb 9, 2022

CVE Published

via MITRE·10:05 PM

Data Sourced

via MITRE·10:05 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-22542?

The severity of CVE-2022-22542 is classified as critical due to the exposure of sensitive personal information.

How do I fix CVE-2022-22542?

To fix CVE-2022-22542, apply the latest patches provided by SAP for affected versions of S/4HANA.

What versions of SAP S/4HANA are affected by CVE-2022-22542?

CVE-2022-22542 affects SAP S/4HANA versions 104, 105, and 106.

What data is exposed in CVE-2022-22542?

CVE-2022-22542 exposes the private address and bank details of Employee Business Partners.

Who is at risk from the CVE-2022-22542 vulnerability?

Actors who have unauthorized access can exploit CVE-2022-22542 to retrieve sensitive personal information.