CVE-2022-41260: XSS

Published Nov 8, 2022

Updated

SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web script via a GET request. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

Affected Software

1 affected component

SAP Financial Consolidation=1010

Event History

Nov 8, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-41260?

CVE-2022-41260 has a low to moderate severity due to its limited impact on confidentiality and integrity.

How do I fix CVE-2022-41260?

To mitigate CVE-2022-41260, ensure that user-controlled input is properly encoded and validated to prevent injection attacks.

Who is affected by CVE-2022-41260?

CVE-2022-41260 affects users of SAP Financial Consolidation version 1010.

Can an authenticated user exploit CVE-2022-41260?

No, CVE-2022-41260 can be exploited by an unauthenticated attacker.

What type of attack does CVE-2022-41260 enable?

CVE-2022-41260 enables cross-site scripting attacks via injected web scripts in GET requests.