CVE-2022-41260
published 2022-11-08CVE-2022-41260: SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.47%
40.3th percentile
SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web script via a GET request. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | financial_consolidation | — | — |
| sap_se | sap_financial_consolidation | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP Financial Consolidation 1010 GET Request cross site scripting (EUVD-2022-44469)
vuldb·2026-08-01·CVSS 6.1
CVE-2022-41260 [MEDIUM] SAP Financial Consolidation 1010 GET Request cross site scripting (EUVD-2022-44469)
A vulnerability marked as problematic has been reported in SAP Financial Consolidation 1010. Affected by this issue is some unknown functionality of the component GET Request Handler. The manipulation leads to cross site scripting.
This vulnerability is listed as CVE-2022-41260. The attack may be initiated remotely. There is no available exploit.
To fix this issue, it is recommended to deploy a patch.
OSV
request-tracker4 vulnerabilities
osv·2023-12-04·CVSS 7.5
CVE-2021-38562 request-tracker4 vulnerabilities
request-tracker4 vulnerabilities
It was discovered that Request Tracker incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2021-38562, CVE-2022-25802, CVE-2023-41259,
CVE-2023-41260)
GHSA
GHSA-5jf9-cm59-7568: SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a
ghsa_unreviewed·2022-11-09
CVE-2022-41260 [MEDIUM] CWE-601 GHSA-5jf9-cm59-7568: SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a
SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web script via a GET request. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-08
Published