CVE-2022-35293

CRITICAL

SAP Enable Now Manager - Unauthenticated Account Access via Insecure Session Management

Title source: llm
STIX 2.1

Description

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/3210566

Scores

CVSS v3 9.1
EPSS 0.0063
EPSS Percentile 45.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-862
Status published
Products (2)
sap/enable_now_manager 1.0
SAP SE/SAP Enable Now Manager 1.0
Published Aug 10, 2022
Tracked Since Feb 18, 2026