Input Validation Flaw in SAP NetWeaver Development Infrastructure
CVE-2022-29618

6.1MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver Development Infrastructure (design Time Repository)
Vendor
CVE Published:
14 June 2022

Summary

An input validation flaw exists in SAP NetWeaver Development Infrastructure (Design Time Repository) that permits unauthenticated attackers to inject scripts via the URL. This allows them to execute arbitrary code in users' browsers. Exploitation of this vulnerability enables attackers to view and potentially alter sensitive information, posing a risk to the confidentiality and integrity of the application.

Affected Version(s)

SAP NetWeaver Development Infrastructure (Design Time Repository) 7.30

SAP NetWeaver Development Infrastructure (Design Time Repository) 7.31

SAP NetWeaver Development Infrastructure (Design Time Repository) 7.40

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3197927
x_refsource_MISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.