CVE-2022-22542: sap se sap s/4hana (supplier factsheet and enterprise search for business partner, supplier and customer)

Vulnerability summary

CVE-2022-22542 is a medium (CVSS 6.5) vulnerability in sap se sap s/4hana (supplier factsheet and enterprise search for business partner, supplier and customer). EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities.

Timeline

1. 09-02-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.