Read the docs
TI-2022-15969 Aliases CVE-2022-35291GHSA-mj46-hjj8-xr5c

Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)

Priority LOW 37CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application

Why it matters now

EPSS 0.00732 54th percentileScored 2026-11-07
Fix Fixed SAP SuccessFactors Mobile Application for Android & iOS devices (SAP SuccessFactors): V8.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAP SuccessFactorsSAP SuccessFactors Mobile Application for Android & iOS devicesbefore V8.0.5V8.0.5Patch availableCNA
  • SAP SuccessFactors Mobile Application for Android & iOS devices VendorSAP SuccessFactors Affected before V8.0.5 Fixed in V8.0.5 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sap:successfactors_mobile:8.0.5:*:*:*:*:android:*:*8.0.5VulnerableSAP
cpe:2.3:a:sap:successfactors_mobile:8.0.5:*:*:*:*:iphone_os:*:*8.0.5VulnerableSAP
  • cpe:2.3:a:sap:successfactors_mobile:8.0.5:*:*:*:*:android:*:* Versions 8.0.5 Vulnerable ·SAP
  • cpe:2.3:a:sap:successfactors_mobile:8.0.5:*:*:*:*:iphone_os:*:* Versions 8.0.5 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP SuccessFactors Mobile Application for Android & iOS devices (SAP SuccessFactors) Fixed in V8.0.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35291
  2. 2026-10-03 Alias added: GHSA-mj46-hjj8-xr5c

References

Advisory 2

  • TI-2021-17545 A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences