Read the docs
TI-2022-13513 Aliases CVE-2022-31589GHSA-vhrf-gfcg-4676

Incorrect authorization in SAP ERP, localization for CEE countries.

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.

Why it matters now

EPSS 0.00682 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP ERP, localization for CEE countries.C-CEE 110_600; 110_602; 110_603; 110_604; 110_700—No fix listedCNA
SAPSAP FinancialsSAP_FIN 618; 720—No fix listedCNA
SAPSAP S/4Hana CoreS4CORE 100; 101; 102; 103; 104; 105; 106; 107; 108—No fix listedCNA
  • SAP ERP, localization for CEE countries. VendorSAP Affected C-CEE 110_600; 110_602; 110_603; 110_604; 110_700 Fixed in — No fix listed CNA
  • SAP Financials VendorSAP Affected SAP_FIN 618; 720 Fixed in — No fix listed CNA
  • SAP S/4Hana Core VendorSAP Affected S4CORE 100; 101; 102; 103; 104; 105; 106; 107; 108 Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:sap:erp_financial_accounting:618:*:*:*:*:*:*:*618VulnerableSAP
cpe:2.3:a:sap:erp_financial_accounting:720:*:*:*:*:*:*:*720VulnerableSAP
cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_600:*:*:*:*:*:*:*c-cee_110_600VulnerableSAP
cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_602:*:*:*:*:*:*:*c-cee_110_602VulnerableSAP
cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_603:*:*:*:*:*:*:*c-cee_110_603VulnerableSAP
cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_604:*:*:*:*:*:*:*c-cee_110_604VulnerableSAP
cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_700:*:*:*:*:*:*:*c-cee_110_700VulnerableSAP
cpe:2.3:a:sap:s\/4hana:100:*:*:*:*:*:*:*100VulnerableSAP
cpe:2.3:a:sap:s\/4hana:101:*:*:*:*:*:*:*101VulnerableSAP
cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*102VulnerableSAP
  • cpe:2.3:a:sap:erp_financial_accounting:618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_financial_accounting:720:*:*:*:*:*:*:* Versions 720 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_600:*:*:*:*:*:*:* Versions c-cee_110_600 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_602:*:*:*:*:*:*:* Versions c-cee_110_602 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_603:*:*:*:*:*:*:* Versions c-cee_110_603 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_604:*:*:*:*:*:*:* Versions c-cee_110_604 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_localization_for_cee_countries:c-cee_110_700:*:*:*:*:*:*:* Versions c-cee_110_700 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*104VulnerableSAP
cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*105VulnerableSAP
cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*106VulnerableSAP
cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:*107VulnerableSAP
cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:*108VulnerableSAP
  • cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:* Versions 106 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:* Versions 107 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:* Versions 108 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31589
  2. 2026-10-03 Alias added: GHSA-vhrf-gfcg-4676
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Advisory 2

  • TI-2021-15843 Missing authorization in SAP ERP Financial Accounting CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences