Auth bypass in SAP Access Control

CVE-2022-39801

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and completely compromise the application.

Vulnerability class: Broken Authentication

EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

  • cna@sap.com (x_refsource_MISC, Vendor Advisory)
  • cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-39801?
CVE-2022-39801 is a high-severity vulnerability in SAP Access Control, classified under Improper Authentication. CVSS score: 7.5/10. Published 2022-09-13.
How severe is CVE-2022-39801?
High severity. CVSS v3 base score is 7.5 out of 10.