CVE-2022-22534: XSS

Published Feb 9, 2022

Updated

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.

Affected Software

12 affected components

SAP NetWeaver=700

SAP NetWeaver=701

SAP NetWeaver=702

SAP NetWeaver=731

SAP NetWeaver=740

SAP NetWeaver=750

SAP NetWeaver=751

SAP NetWeaver=752

SAP NetWeaver=753

SAP NetWeaver=754

SAP NetWeaver=755

SAP NetWeaver=756

Event History

Feb 9, 2022

CVE Published

via MITRE·10:05 PM

Data Sourced

via MITRE·10:05 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this SAP NetWeaver vulnerability?

The vulnerability ID for this SAP NetWeaver vulnerability is CVE-2022-22534.

What is the severity of CVE-2022-22534?

The severity of CVE-2022-22534 is medium with a CVSS score of 6.1.

How does CVE-2022-22534 impact confidentiality?

CVE-2022-22534 can partially impact the confidentiality of the application by exposing sensitive data like user ID and password.

Which versions of SAP NetWeaver are affected by CVE-2022-22534?

Versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, and 756 of SAP NetWeaver are affected by CVE-2022-22534.

How can I fix CVE-2022-22534 in SAP NetWeaver?

To fix CVE-2022-22534 in SAP NetWeaver, apply the necessary security patches provided by SAP as referenced in the SAP notes and documents.