PT-2022-18882 · Sap · Sap Netweaver

Published 2022-06-13 · Updated 2023-01-30 · CVE-2022-28217

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (EP Web Page Composer) (affected versions not specified)

Description The issue arises from insufficient validation of an XML document accepted from an untrusted source. This allows an adversary to exploit unprotected XML parking at endpoints and conduct SSRF attacks, potentially compromising the system's availability by causing it to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-28217

Affected Products

Sap Netweaver

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3148377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28217 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28217 · Vendor Advisory
• https://t.me/cvenotify/43100 · Telegram Post
• https://t.me/cibsecurity/44317 · Telegram Post