CVE-2022-35298 — Cross-site Scripting in SE SAP Netweaver Enterprise Portal

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 32.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Netweaver Enterprise PortalSAP Netweaver Enterprise Portal
Timeline
PublishedSep 13
Latest updateSep 14

Description

SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-99f6-2857-qp6f: SAP NetWeaver Enterprise Portal (KMC) - version 7↗2022-09-14
▶
CVEList
CVE-2022-35298: SAP NetWeaver Enterprise Portal (KMC) - version 7↗2022-09-13
▶
CVE-2022-35298 — Cross-site Scripting | cvebase