PT-2022-4924 · Sap · Sap Enterprise Portal

Published 2022-07-05 · Updated 2023-01-30 · CVE-2022-35224

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Enterprise Portal versions 7.10 through 7.50

Description The issue is related to the lack of protection for the web page structure, allowing a remote attacker to view, add, modify, or delete data. This is due to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. The attack can be used to non-permanently deface or modify portal content, and the execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of the victim's web browser session.

Recommendations For SAP Enterprise Portal versions 7.10 through 7.50, consider disabling the execution of user-controlled script content as a temporary workaround until a patch is available. Restrict access to user-controlled inputs to minimize the risk of exploitation. Avoid using the portal with user-controlled inputs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06105

CVE-2022-35224

Affected Products

Sap Enterprise Portal

References · 8

• https://bdu.fstec.ru/vul/2022-06105 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3210779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35224 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35224 · Vendor Advisory
• https://t.me/cvenotify/32969 · Telegram Post
• https://vuldb.com/ru/?id.203792 · Note
• https://t.me/cibsecurity/46107 · Telegram Post