CVE-2022-29618

published 2022-06-14

CVE-2022-29618: Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an…

Priority P4 30 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to inject script into the URL and execute code in the user’s browser. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap_se	sap_netweaver_development_infrastructure	—	—
sap_se	sap_netweaver_development_infrastructure	—	—
sap_se	sap_netweaver_development_infrastructure	—	—
sap_se	sap_netweaver_development_infrastructure	—	—

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79