Reflected Cross-Site Scripting Vulnerability in SAP NetWeaver Enterprise Portal

CVE-2022-35225

What is CVE-2022-35225?

SAP NetWeaver Enterprise Portal versions 7.10 to 7.50 exhibit a reflected Cross-Site Scripting (XSS) vulnerability due to the inadequate encoding of user-controlled inputs when transmitted over the network. This flaw may potentially alter the scope of an attack, enabling malicious actors to exploit it. Although the primary impact relates to limited confidentiality and integrity of data, it poses a threat to user sessions and can lead to unauthorized data access.

References