CVE-2022-27656

Published: May 11, 2022Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected (21)

Products: Sap: Netweaver As Abap Kernel, Netweaver As Abap Krnl64uc, Webdispatcher

Sap

3 products

Netweaver As Abap Kernel

Netweaver As Abap Krnl64uc

Webdispatcher

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver As Abap Kernel	Version 7.22
Sap Netweaver As Abap Kernel	Version 7.49
Sap Netweaver As Abap Kernel	Version 7.53
Sap Netweaver As Abap Kernel	Version 7.77
Sap Netweaver As Abap Kernel	Version 7.81
Sap Netweaver As Abap Kernel	Version 7.85
Sap Netweaver As Abap Kernel	Version 7.86
Sap Netweaver As Abap Kernel	Version 7.87
Sap Netweaver As Abap Kernel	Version 8.04
Sap Netweaver As Abap Krnl64uc	Version 7.22
Sap Netweaver As Abap Krnl64uc	Version 7.22ext
Sap Netweaver As Abap Krnl64uc	Version 7.49
Sap Netweaver As Abap Krnl64uc	Version 7.53
Sap Netweaver As Abap Krnl64uc	Version 8.04
Sap Webdispatcher	Version 7.22ext
Sap Webdispatcher	Version 7.49
Sap Webdispatcher	Version 7.53
Sap Webdispatcher	Version 7.77
Sap Webdispatcher	Version 7.81
Sap Webdispatcher	Version 7.83
Sap Webdispatcher	Version 7.85