Vulnerability Description
Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver Application Server Abap | 700 |
Related Weaknesses (CWE)
References
- https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3145997Permissions RequiredVendor Advisory
- https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3145997Permissions RequiredVendor Advisory
FAQ
What is CVE-2022-26102?
CVE-2022-26102 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction ...
How severe is CVE-2022-26102?
CVE-2022-26102 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-26102?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Netweaver Application Server Abap.