CVE-2022-27656

6.1MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver As For Abap And Java (icm Administration Ui)
SAP Web Dispatcher (web Administration Ui)
Vendor
CVE Published:
11 May 2022

Summary

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected Version(s)

SAP NetWeaver AS for ABAP and Java (ICM Administration UI) KRNL64NUC 7.22

SAP NetWeaver AS for ABAP and Java (ICM Administration UI) 7.22EXT

SAP NetWeaver AS for ABAP and Java (ICM Administration UI) 7.49

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3145046
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.