PT-2022-4935 · Sap · Sap Nw Ep

Published 2022-07-05 · Updated 2022-07-20 · CVE-2022-35227

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NW EP (WPC) versions 7.30 through 7.50

Description A vulnerability in SAP NW EP (WPC) does not sufficiently validate user-controlled input, allowing a remote attacker to conduct a Cross-Site (XSS) scripting attack. This could lead to the execution of arbitrary script code, potentially resulting in the stealing or modifying of authentication information, such as data related to the user's current session.

Recommendations For versions 7.30 through 7.50, update to a version that includes the fix for this issue to prevent Cross-Site Scripting attacks. As a temporary workaround, consider implementing additional input validation measures to restrict the execution of arbitrary script code until a patch is available. Restrict access to sensitive user data to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06116

CVE-2022-35227

Affected Products

Sap Nw Ep

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3211760 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06116 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35227 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35227 · Vendor Advisory
• https://t.me/cvenotify/32967 · Telegram Post
• https://vuldb.com/ru/?id.203783 · Note