cbcvebase.
CVE-2022-22534
published 2022-02-09

CVE-2022-22534: Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and…

PriorityP431medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.83%
53.4th percentile
Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.

Affected

24 ranges
VendorProductVersion rangeFixed in
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sapnetweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——
sap_sesap_netweaver——

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.