PT-2022-4082 · Sap · Sap Netweaver Enterprise Portal

Published 2022-07-04 · Updated 2022-07-20 · CVE-2022-35225

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50

Description The issue is related to insufficient encoding of user-controlled inputs over the network, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability can be exploited by a remote attacker to conduct cross-site scripting attacks, which may lead to limited impact on confidentiality and integrity of data.

Recommendations For SAP NetWeaver Enterprise Portal versions 7.10 through 7.50, consider implementing proper input validation and encoding to prevent reflected XSS attacks. As a temporary workaround, restrict access to sensitive data and functions to minimize the risk of exploitation. Ensure that all user-controlled inputs are thoroughly validated and sanitized before being processed by the application.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04916

CVE-2022-35225

Affected Products

Sap Netweaver Enterprise Portal

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35225 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35225 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3208880 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04916 · Security Note
• https://t.me/cvenotify/32968 · Telegram Post
• https://t.me/cibsecurity/46105 · Telegram Post