Read the docs
TI-2022-06817 Aliases CVE-2022-22542GHSA-m397-7g87-cgqv

Information disclosure in SAP S/4HANA

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.

Why it matters now

EPSS 0.00903 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)104; 105; 106—No fix listedCNA
  • SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) VendorSAP Affected 104; 105; 106 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*104VulnerableSAP
cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*105VulnerableSAP
cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*106VulnerableSAP
  • cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:* Versions 106 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22542
  2. 2026-10-03 Alias added: GHSA-m397-7g87-cgqv

References

Advisory 2

  • TI-2026-00296 Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) CVSS 3.1CRITICAL 9.9
  • TI-2021-15854 SQL injection in SAP S/4HANA CVSS 3.1HIGH 8.8
  • TI-2022-06806 The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103… CVSS 3.1HIGH 8.1
  • TI-2022-06805 The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103… CVSS 3.1HIGH 8.1
  • TI-2022-13513 Incorrect authorization in SAP ERP, localization for CEE countries. CVSS 3.1MEDIUM 6.5
  • TI-2023-10145 Missing authorization in SAP S/4 HANA CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences