A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site (XSS) scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to stealing or modifying of authentication information of the user, such as data relating to his or her current session.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3211760 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Jul 2022, 18:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3211760 - Permissions Required, Vendor Advisory | |
| CPE | cpe:2.3:a:sap:netweaver_enterprise_portal:7.40:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_enterprise_portal:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_enterprise_portal:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
12 Jul 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-12 21:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-35227
Mitre link : CVE-2022-35227
CVE.ORG link : CVE-2022-35227
JSON object : View
Products Affected
sap
- netweaver_enterprise_portal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')