CVE-2022-29610 - SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack

Back Back to CVE browser

MEDIUM

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack

Published May 11, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.46%

Description

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack.

Affected products

Vendor SAP SE Product SAP NetWeaver Application Server ABAP Default
n/a
- Version
  753
  Status
  affected
  Constraints
  -
- Version
  754
  Status
  affected
  Constraints
  -
- Version
  755
  Status
  affected
  Constraints
  -
- Version
  756
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver Application Server ABAP

n/a

Version	Status	Constraints
753	affected	-
754	affected	-
755	affected	-
756	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33941
Advisory
https://launchpad.support.sap.com/#/notes/3146336
x_refsource_MISCPermissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33941		Advisory
https://launchpad.support.sap.com/#/notes/3146336		x_refsource_MISCPermissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html		x_refsource_MISCVendor Advisory