Auth bypass in SAP Access Control
CVE-2022-39801
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and completely compromise the application.
Vulnerability class: Broken Authentication
EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap Access_control — versions 12
- Sap Se Grc Access Control Emergency Management — versions V1100_700, V1100_731, V1200_750
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-39801?
- CVE-2022-39801 is a high-severity vulnerability in SAP Access Control, classified under Improper Authentication. CVSS score: 7.5/10. Published 2022-09-13.
- How severe is CVE-2022-39801?
- High severity. CVSS v3 base score is 7.5 out of 10.