PT-2022-18552 · Sap · Sap Web Dispatcher+1

Published 2022-05-11 · Updated 2022-05-19 · CVE-2022-27656

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Web Dispatcher and Internet Communication Manager (ICM) (affected versions not specified)

Description The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27656

Affected Products

Internet Communication Manager

Sap Web Dispatcher

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27656 · Security Note
• https://launchpad.support.sap.com/#/notes/3145046 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27656 · Vendor Advisory
• https://t.me/cibsecurity/42355 · Telegram Post