PT-2022-24996 · Sap · Sap Gui For Html

Published 2022-09-13 · Updated 2025-06-10 · CVE-2022-39799

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP GUI for HTML (affected versions not specified)

Description The issue allows an attacker with no prior authentication to craft and send malicious scripts to SAP GUI for HTML within Fiori Launchpad, resulting in a reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-39799

Affected Products

Sap Gui For Html

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39799 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3229820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39799 · Security Note
• https://t.me/cvenotify/36249 · Telegram Post
• https://t.me/cvenotify/36102 · Telegram Post
• https://t.me/cvenotify/125252 · Telegram Post
• https://t.me/cibsecurity/49665 · Telegram Post