CVE-2022-35291CWE-269

Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)

High · published July 27, 2022

CVSS v3.1
8.1
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00732 · 53.8th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2022-07-27T13:30Z
EPSS history
Timeline
  • 27 JUL 13:30Z
    Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)
    cvelistv5