What is CVE-2022-28217?

CVE-2022-28217 is a medium-severity vulnerability in SAP Netweaver, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2022-06-13.

How severe is CVE-2022-28217?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SSRF in SAP Netweaver

CVE-2022-28217

Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.007 (49.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Sap Netweaver — versions 7.20, 7.30, 7.31
Sap Se Netweaver (Ep Web Page Composer) — versions 7.20, 7.30, 7.31

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-28217?: CVE-2022-28217 is a medium-severity vulnerability in SAP Netweaver, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2022-06-13.
How severe is CVE-2022-28217?: Medium severity. CVSS v3 base score is 6.5 out of 10.