PT-2022-16672 · Sap · Sap Netweaver Enterprise Portal

Published 2022-03-09 · Updated 2022-03-16 · CVE-2022-24397

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.30, 7.31, 7.40, 7.50

Description The issue arises from insufficient encoding of user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability can be exploited to non-permanently deface or modify the displayed content of the portal website. If a victim registered on the portal executes the script content, it could compromise the confidentiality and integrity of the victim's web browser.

Recommendations For versions 7.30, 7.31, 7.40, 7.50, consider disabling the execution of user-controlled inputs until a patch is available to prevent the exploitation of the reflected Cross-Site Scripting vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24397

Affected Products

Sap Netweaver Enterprise Portal

References · 5

• https://launchpad.support.sap.com/#/notes/3146260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24397 · Security Note
• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24397 · Vendor Advisory
• https://t.me/cibsecurity/38726 · Telegram Post