CVE-2022-35290

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
SAP SE	SAP Authenticator for Android	>= unspecified, < 1.2.17

References

https://launchpad.support.sap.com/#/notes/3216653Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3216653Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Aug 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-352918.1Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities wi CVE-2022-352927.8In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to CVE-2022-352939.1Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploi CVE-2022-352945.4An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is t CVE-2022-352954.9In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves.CVE-2022-352964.9Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive i CVE-2022-352975.4The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being CVE-2022-352986.1SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting CVE-2022-352999.8SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a me CVE-2022-35335.7A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tool CVE-2022-35348.0A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups CVE-2022-35368.8The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not