CVE-2022-31589

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-14 · updated 2026-06-17
Weakness: CWE-863

Description

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.

Affected products

SAP SE SAP ERP Financial Accounting (RFOPENPOSTING_FR): 618, 720
SAP Erp Localization For Cee Countries: c-cee_110_600, c-cee_110_602, c-cee_110_603, c-cee_110_604, c-cee_110_700
SAP S/4Hana: 100, 101, 102, 103, 104, 105 (+3)

References

https://launchpad.support.sap.com/#/notes/3203065
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://launchpad.support.sap.com/#/notes/3203065
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Get alerted when CVE-2022-31589 or the next vulnerability affects your stack