SAP Access Control vulnerabilities

2 CVEs affecting SAP Access Control, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-39801, published 2022-09-13.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-44233, published 2021-12-14. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.
• CVE-2022-39801, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only…