// For flags

CVE-2022-41207

 

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victim to a malicious site of the attacker's choosing which can result in disclosure or modification of the victim's information.

SAP Biller Direct permite que un atacante no autenticado cree una URL de apariencia legítima. Cuando una víctima desprevenida hace clic en él, utilizará un parámetro no sensible para redirigir a la víctima a un sitio malicioso elegido por el atacante, lo que puede resultar en la divulgación o modificación de la información de la víctima.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-21 CVE Reserved
  • 2022-11-08 CVE Published
  • 2024-04-20 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
 Biller Direct
Search vendor "Sap" for product "Biller Direct"
 635
Search vendor "Sap" for product "Biller Direct" and version "635"
-
Affected
Sap
Search vendor "Sap"
 Biller Direct
Search vendor "Sap" for product "Biller Direct"
 750
Search vendor "Sap" for product "Biller Direct" and version "750"
-
Affected