Reflected Cross-Site Scripting Vulnerability in SAP GUI for HTML within Fiori Launchpad

CVE-2022-39799

What is CVE-2022-39799?

A vulnerability exists in SAP GUI for HTML within the Fiori Launchpad, allowing potentially malicious actors to execute a reflected cross-site scripting attack. An attacker could send crafted malicious scripts without prior authentication, targeting the SAP GUI for HTML. This exploitation could result in the theft of session information, granting the attacker the ability to impersonate users and gain unauthorized access to sensitive data and functionality.

References