CVE-2022-35291

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application

• CWE-269

• https://launchpad.support.sap.com/#/notes/3226411Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://launchpad.support.sap.com/#/notes/3226411Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Jul 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35286IBM Security Verify Information Queue 10.0.2 is vulnerable t…8.8
• CVE-2022-35287IBM Security Verify Information Queue 10.0.2 contains hard-c…7.5
• CVE-2022-35288IBM Security Verify Information Queue 10.0.2 could allow a u…6.5
• CVE-2022-35289A write-what-where condition in hermes caused by an integer …9.8
• CVE-2022-3529Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35290Under certain conditions SAP Authenticator for Android allow…7.5
• CVE-2022-35292In SAP Business One application when a service is created, t…7.8
• CVE-2022-35293Due to insecure session management, SAP Enable Now allows an…9.1
• CVE-2022-35294An attacker with basic business user privileges could craft …5.4
• CVE-2022-35295In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may…4.9
• CVE-2022-35296Under certain conditions, the application SAP BusinessObject…4.9
• CVE-2022-35297The application SAP Enable Now does not sufficiently encode …5.4