CVE-2022-35294

Published: Sep 13, 2022Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.

Affected (11)

Products: Sap: Netweaver Application Server Abap

Sap

1 product

Netweaver Application Server Abap

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver Application Server Abap	Version 7.22ext
Sap Netweaver Application Server Abap	Version 7.49
Sap Netweaver Application Server Abap	Version 7.53
Sap Netweaver Application Server Abap	Version 7.54
Sap Netweaver Application Server Abap	Version 7.77
Sap Netweaver Application Server Abap	Version 7.81
Sap Netweaver Application Server Abap	Version 7.85
Sap Netweaver Application Server Abap	Version 7.89
Sap Netweaver Application Server Abap	Version kernel_7.22
Sap Netweaver Application Server Abap	Version krnl64nuc_7.22
Sap Netweaver Application Server Abap	Version krnl64uc_7.22