CVE-2022-28217: SSRF
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system?s Availability by causing system to crash.
Other sources
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-28217?
CVE-2022-28217 is a vulnerability in SAP NetWeaver (EP Web Page Composer) that allows an adversary to exploit unprotected XML parking and conduct SSRF attacks.
What is the severity of CVE-2022-28217?
CVE-2022-28217 has a severity rating of 6.5, which is classified as medium.
Which versions of SAP NetWeaver are affected by CVE-2022-28217?
CVE-2022-28217 affects SAP NetWeaver versions 7.20, 7.30, 7.31, 7.40, and 7.50.
How can CVE-2022-28217 be fixed?
To fix CVE-2022-28217, it is recommended to apply the patches and updates provided by SAP.
Where can I find more information about CVE-2022-28217?
More information about CVE-2022-28217 can be found in the SAP Note 3148377 and the SAP security advisory.