CVE-2022-35294: XSS
An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2022-35294.
What is the severity level of CVE-2022-35294?
The severity level of CVE-2022-35294 is medium with a CVSS score of 5.4.
How does CVE-2022-35294 impact SAP NetWeaver Application Server ABAP?
CVE-2022-35294 allows an attacker with basic business user privileges to upload a malicious file to SAP NetWeaver Application Server ABAP, which can lead to a stored Cross-Site-Scripting attack and information disclosure.
Which versions of SAP NetWeaver Application Server ABAP are affected by CVE-2022-35294?
SAP NetWeaver Application Server ABAP versions 7.22ext, 7.49, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, kernel_7.22, krnl64nuc_7.22, and krnl64uc_7.22 are affected by CVE-2022-35294.
What is the recommended action to fix CVE-2022-35294?
To fix CVE-2022-35294, it is recommended to apply the necessary security patches provided by SAP as mentioned in the SAP Notes 3218177.