CVE-2022-1248CWE-287

SAP Information System POST Request add_admin.php improper authentication

High · published April 6, 2022

CVSS v3.1
7.3
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web application with a simple POST request. Exploit details were disclosed.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01353 · 71.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-04-06T03:10Z
EPSS history
Timeline
  • 06 APR 03:10Z
    SAP Information System POST Request add_admin.php improper authentication
    cvelistv5