PT-2022-4083 · Sap · Sap Netweaver Enterprise Portal

Published 2022-07-04 · Updated 2022-07-20 · CVE-2022-35170

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50

Description The issue is related to insufficient encoding of user-controlled inputs over the network, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability can be exploited by a remote attacker to conduct cross-site scripting attacks, potentially leading to limited impact on confidentiality and integrity of data.

Recommendations For SAP NetWeaver Enterprise Portal versions 7.10 through 7.50, consider implementing proper input encoding to prevent reflected Cross-Site Scripting (XSS) attacks. As a temporary workaround, restrict access to sensitive data and functions to minimize the risk of exploitation. Ensure that all user-controlled inputs are properly validated and sanitized to prevent malicious code injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04917

CVE-2022-35170

Affected Products

Sap Netweaver Enterprise Portal

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35170 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35170 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3208819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04917 · Security Note
• https://vuldb.com/ru/?id.203753 · Note
• https://t.me/cvenotify/32972 · Telegram Post
• https://t.me/cibsecurity/46092 · Telegram Post