CVE-2022-22542: Infoleak
First published: Wed Feb 09 2022(Updated: )
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP S/4HANA | =104 | |
| SAP S/4HANA | =105 | |
| SAP S/4HANA | =106 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-22542?
The severity of CVE-2022-22542 is classified as critical due to the exposure of sensitive personal information.
How do I fix CVE-2022-22542?
To fix CVE-2022-22542, apply the latest patches provided by SAP for affected versions of S/4HANA.
What versions of SAP S/4HANA are affected by CVE-2022-22542?
CVE-2022-22542 affects SAP S/4HANA versions 104, 105, and 106.
What data is exposed in CVE-2022-22542?
CVE-2022-22542 exposes the private address and bank details of Employee Business Partners.
Who is at risk from the CVE-2022-22542 vulnerability?
Actors who have unauthorized access can exploit CVE-2022-22542 to retrieve sensitive personal information.
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap s/4hana
- version/sap s/4hana/104
- version/sap s/4hana/105
- version/sap s/4hana/106