CVE-2022-35293

CRITICAL

SAP Enable Now Manager - Unauthenticated Account Access via Insecure Session Management

Title source: llm
STIX 2.1

Description

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/3210566

Scores

CVSS v3 9.1
EPSS 0.0066
EPSS Percentile 71.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-862
Status published
Products (1)
sap/enable_now_manager 1.0
Published Aug 10, 2022
Tracked Since Feb 18, 2026