PT-2022-15504 · Sap · Sap Netweaver

Published 2022-02-09 · Updated 2022-10-27 · CVE-2022-22534

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (affected versions not specified)

Description The issue is caused by insufficient encoding of user input, allowing an unauthenticated attacker to inject code. This can expose sensitive data, such as user id and password. The affected endpoints are typically exposed over the network, and successful exploitation can impact the confidentiality of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22534

Affected Products

Sap Netweaver

References · 4

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22534 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22534 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3124994 · Note