CRITICAL: CVE-2022-35293 (CVSS 9.1) — sap enable now manager

CVE: CVE-2022-35293

CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: CRITICAL

Status: Critical advisory

Affected

• sap enable now manager

Summary

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.

Verified Sources

• NVD entry
• GitHub Advisory
• MITRE

References

• https://launchpad.support.sap.com/#/notes/3210566
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
• https://launchpad.support.sap.com/#/notes/3210566
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._