CVE-2022-29613
CVE-2022-29613
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
11 May 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application.
Affected products
SAP SE · SAP Employee Self Service (Fiori My Leave Request)Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →