XSS in SAP Netweaver Enterprise Portal
CVE-2022-35227
A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site (XSS) scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to stealing or modifying of authentication information of the user, such as data relating to his or her current session.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (48.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sap Netweaver_enterprise_portal — versions 7.30, 7.31, 7.40
- Sap Se Netweaver Enterprise Portal (Wpc) — versions 7.30, 7.31, 7.40
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-35227?
- CVE-2022-35227 is a medium-severity vulnerability in SAP Netweaver Enterprise Portal, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2022-07-12.
- How severe is CVE-2022-35227?
- Medium severity. CVSS v3 base score is 6.1 out of 10.