Read the docs
TI-2022-13519 Aliases CVE-2022-31595GHSA-m3m5-474m-99qj

Missing authorization in SAP Financial Consolidation

Priority LOW 39CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Why it matters now

EPSS 0.00802 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Financial Consolidation1010—No fix listedCNA
  • SAP Financial Consolidation VendorSAP Affected 1010 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:sap:adaptive_server_enterprise:kernel_7.22:*:*:*:*:*:*:*kernel_7.22VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:kernel_7.49:*:*:*:*:*:*:*kernel_7.49VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:kernel_7.53:*:*:*:*:*:*:*kernel_7.53VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64nuc_7.22:*:*:*:*:*:*:*krnl64nuc_7.22VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64nuc_7.22ext:*:*:*:*:*:*:*krnl64nuc_7.22extVulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64nuc_7.49:*:*:*:*:*:*:*krnl64nuc_7.49VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.22:*:*:*:*:*:*:*krnl64uc_7.22VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.22ext:*:*:*:*:*:*:*krnl64uc_7.22extVulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.49:*:*:*:*:*:*:*krnl64uc_7.49VulnerableSAP
cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.53:*:*:*:*:*:*:*krnl64uc_7.53VulnerableSAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:kernel_7.49:*:*:*:*:*:*:* Versions kernel_7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64nuc_7.22:*:*:*:*:*:*:* Versions krnl64nuc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64nuc_7.22ext:*:*:*:*:*:*:* Versions krnl64nuc_7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64nuc_7.49:*:*:*:*:*:*:* Versions krnl64nuc_7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.22:*:*:*:*:*:*:* Versions krnl64uc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.22ext:*:*:*:*:*:*:* Versions krnl64uc_7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.49:*:*:*:*:*:*:* Versions krnl64uc_7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:adaptive_server_enterprise:krnl64uc_7.53:*:*:*:*:*:*:* Versions krnl64uc_7.53 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31595
  2. 2026-10-03 Alias added: GHSA-m3m5-474m-99qj

References

Advisory 2

  • TI-2020-05099 Code injection in SAP Adaptive Server Enterprise CVSS 3.1HIGH 8.8
  • TI-2020-05097 SQL injection in SAP Adaptive Server Enterprise CVSS 3.1HIGH 8.8
  • TI-2018-01848 Under certain conditions SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0… CVSS 3.0HIGH 7.5
  • TI-2018-01847 Under certain conditions the backup server in SAP Adaptive Server Enterprise (ASE)… CVSS 3.0HIGH 7.5
  • TI-2022-06803 Uncontrolled search path in SAP Adaptive Server Enterprise CVSS 3.1HIGH 7.8
  • TI-2020-05147 Sensitive information in log files in SAP Adaptive Server Enterprise CVSS 3.1HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences