Disclosure Management
CVE-2022-41274
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can lead to the exposure of data like financial reports.
AnalysisAI
SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can lead to the exposure of data like financial reports. Affected products include: Sap Disclosure Management. Version information: version 10.1.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.
More in Disclosure Management
View allSAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. Rated critic
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be
SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, res
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in e
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in e
SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: Whe
SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allo
Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise
SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today