PT-2022-4929 · Sap · Sap Netweaver Enterprise Portal

Published 2022-06-02 · Updated 2022-07-20 · CVE-2022-32247

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50

Description The issue is related to improper sanitization of user inputs, allowing an unauthenticated attacker to execute scripts. This can lead to a limited impact on the confidentiality and integrity of the application, as an attacker can view or modify information. The vulnerability is associated with a lack of protection for the web page structure, enabling a remote attacker to view, add, modify, or delete data.

Recommendations For SAP NetWeaver Enterprise Portal versions 7.10 through 7.50, update to a version that includes proper sanitization of user inputs to prevent script execution attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06110

CVE-2022-32247

Affected Products

Sap Netweaver Enterprise Portal

References · 7

• https://launchpad.support.sap.com/#/notes/3209557 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32247 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32247 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06110 · Security Note
• https://vuldb.com/ru/?id.203751 · Note
• https://t.me/cibsecurity/46088 · Telegram Post