CVE-2022-35225

published 2022-07-12

CVE-2022-35225: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network…

Priority P4 27 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_enterprise_portal	—	—
sap	netweaver_enterprise_portal	—	—
sap	netweaver_enterprise_portal	—	—
sap	netweaver_enterprise_portal	—	—
sap	netweaver_enterprise_portal	—	—
sap	netweaver_enterprise_portal	—	—
sap	netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—
sap_se	sap_netweaver_enterprise_portal	—	—

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79