CVE-2022-31589: SAP ERP Financial Accounting

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.

Affected products

• SAP ERP Financial Accounting: version 618 only; version 720 only
• SAP ERP Localization For Cee Countries: version c-cee_110_600 only; version c-cee_110_602 only; version c-cee_110_603 only; version c-cee_110_604 only; version c-cee_110_700 only
• SAP s/4hana: version 100 only; version 101 only; version 102 only; version 103 only; version 104 only; version 105 only; …

Published 2022-06-14. Last modified 2026-06-17.