CVE-2022-35170 - SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack

Back Back to CVE browser

MEDIUM

SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack

Published Jul 12, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.61%

Description

SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data.

Affected products

Vendor SAP SE Product SAP NetWeaver Enterprise Portal Default
n/a
- Version
  7.10
  Status
  affected
  Constraints
  -
- Version
  7.11
  Status
  affected
  Constraints
  -
- Version
  7.20
  Status
  affected
  Constraints
  -
- Version
  7.30
  Status
  affected
  Constraints
  -
- Version
  7.31
  Status
  affected
  Constraints
  -
- Version
  7.40
  Status
  affected
  Constraints
  -
- Version
  7.50
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver Enterprise Portal

n/a

Version	Status	Constraints
7.10	affected	-
7.11	affected	-
7.20	affected	-
7.30	affected	-
7.31	affected	-
7.40	affected	-
7.50	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38064
Advisory
https://launchpad.support.sap.com/#/notes/3208819
x_refsource_MISCPermissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38064		Advisory
https://launchpad.support.sap.com/#/notes/3208819		x_refsource_MISCPermissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html		x_refsource_MISCVendor Advisory