PT-2022-19731 · Sap · Sap Netweaver Development Infrastructure

Published 2022-06-14 · Updated 2022-06-24 · CVE-2022-29618

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Development Infrastructure (Design Time Repository) versions 7.30, 7.31, 7.40, 7.50

Description The issue is caused by insufficient input validation, allowing an unauthenticated attacker to inject script into the URL and execute code in the user's browser. This can lead to a limited impact on confidentiality and integrity of the application, as an attacker can view or modify information.

Recommendations For versions 7.30, 7.31, 7.40, 7.50, update to a version that includes input validation to prevent script injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29618

Affected Products

Sap Netweaver Development Infrastructure

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29618 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3197927 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29618 · Security Note
• https://t.me/cibsecurity/44437 · Telegram Post