CVE-2022-35291

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-352927.8In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to CVE-2022-352939.1Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploi CVE-2022-352945.4An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is t CVE-2022-352954.9In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves.CVE-2022-352964.9Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive i CVE-2022-352975.4The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being CVE-2022-352986.1SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting CVE-2022-352999.8SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a me CVE-2022-35335.7A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tool CVE-2022-35348.0A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups CVE-2022-35368.8The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not CVE-2022-35378.8The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not valida