CVE-2022-35172 - Vulnerability Details

Vendors	Products
Sap	Netweaver Enterprise Portal

Link	Providers
https://launchpad.support.sap.com/#/notes/3207902
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "SAP NetWeaver Enterprise Portal", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "7.10"}, {"status": "affected", "version": "7.11"}, {"status": "affected", "version": "7.20"}, {"status": "affected", "version": "7.30"}, {"status": "affected", "version": "7.31"}, {"status": "affected", "version": "7.40"}, {"status": "affected", "version": "7.50"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-12T20:28:18", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/3207902"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2022-35172", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP NetWeaver Enterprise Portal", "version": {"version_data": [{"version_affected": "=", "version_value": "7.10"}, {"version_affected": "=", "version_value": "7.11"}, {"version_affected": "=", "version_value": "7.20"}, {"version_affected": "=", "version_value": "7.30"}, {"version_affected": "=", "version_value": "7.31"}, {"version_affected": "=", "version_value": "7.40"}, {"version_affected": "=", "version_value": "7.50"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability."}]}, "impact": {"cvss": {"baseScore": "null", "vectorString": "null", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79"}]}]}, "references": {"reference_data": [{"name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "refsource": "MISC", "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"name": "https://launchpad.support.sap.com/#/notes/3207902", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/3207902"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:29:17.458Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/3207902"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2022-35172", "datePublished": "2022-07-12T20:28:18", "dateReserved": "2022-07-04T00:00:00", "dateUpdated": "2024-08-03T09:29:17.458Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : SAP NetWeaver Enterprise Portal (string)

vendor : SAP SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.10 (string)

}

1 : { »

status : affected (string)

version : 7.11 (string)

}

2 : { »

status : affected (string)

version : 7.20 (string)

}

3 : { »

status : affected (string)

version : 7.30 (string)

}

4 : { »

status : affected (string)

version : 7.31 (string)

}

5 : { »

status : affected (string)

version : 7.40 (string)

}

6 : { »

status : affected (string)

version : 7.50 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2022-07-12T20:28:18 (string)

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://launchpad.support.sap.com/#/notes/3207902 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cna@sap.com (string)

ID : CVE-2022-35172 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : SAP NetWeaver Enterprise Portal (string)

version : { »

version_data : [ »

0 : { »

version_affected : = (string)

version_value : 7.10 (string)

}

1 : { »

version_affected : = (string)

version_value : 7.11 (string)

}

2 : { »

version_affected : = (string)

version_value : 7.20 (string)

}

3 : { »

version_affected : = (string)

version_value : 7.30 (string)

}

4 : { »

version_affected : = (string)

version_value : 7.31 (string)

}

5 : { »

version_affected : = (string)

version_value : 7.40 (string)

}

6 : { »

version_affected : = (string)

version_value : 7.50 (string)

}

]

}

]

}

vendor_name : SAP SE (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. (string)

}

]

}

impact : { »

cvss : { »

baseScore : null (string)

vectorString : null (string)

version : 3.0 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-79 (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

refsource : MISC (string)

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

1 : { »

name : https://launchpad.support.sap.com/#/notes/3207902 (string)

refsource : MISC (string)

url : https://launchpad.support.sap.com/#/notes/3207902 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T09:29:17.458Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://launchpad.support.sap.com/#/notes/3207902 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

assignerShortName : sap (string)

cveId : CVE-2022-35172 (string)

datePublished : 2022-07-12T20:28:18 (string)

dateReserved : 2022-07-04T00:00:00 (string)

dateUpdated : 2024-08-03T09:29:17.458Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.10:*:*:*:*:*:*:*", "matchCriteriaId": "40BA6B1C-F11D-49DF-A3DE-92D1442BC09F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.11:*:*:*:*:*:*:*", "matchCriteriaId": "16A4B1E5-FD7B-4D7F-9791-E865FC8ED476", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.20:*:*:*:*:*:*:*", "matchCriteriaId": "DCCA369A-EA1B-4312-8727-82BA1192D8A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.30:*:*:*:*:*:*:*", "matchCriteriaId": "64F0B5E2-054F-41CC-9296-38E3E5DFC77B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.31:*:*:*:*:*:*:*", "matchCriteriaId": "E666D8FD-1F21-4E97-80BB-D560AB125DB5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.40:*:*:*:*:*:*:*", "matchCriteriaId": "3D61E5F0-5F16-489D-BB7D-2C630637DCAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:*", "matchCriteriaId": "D91F9D76-39D6-4D5E-BFAE-892CB8C30A79", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability."}, {"lang": "es", "value": "SAP NetWeaver Enterprise Portal - versiones 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado"}], "id": "CVE-2022-35172", "lastModified": "2024-11-21T07:10:51.977", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-12T21:15:10.913", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/3207902"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/3207902"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@sap.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.10:*:*:*:*:*:*:* (string)

matchCriteriaId : 40BA6B1C-F11D-49DF-A3DE-92D1442BC09F (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.11:*:*:*:*:*:*:* (string)

matchCriteriaId : 16A4B1E5-FD7B-4D7F-9791-E865FC8ED476 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.20:*:*:*:*:*:*:* (string)

matchCriteriaId : DCCA369A-EA1B-4312-8727-82BA1192D8A2 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.30:*:*:*:*:*:*:* (string)

matchCriteriaId : 64F0B5E2-054F-41CC-9296-38E3E5DFC77B (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.31:*:*:*:*:*:*:* (string)

matchCriteriaId : E666D8FD-1F21-4E97-80BB-D560AB125DB5 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.40:*:*:*:*:*:*:* (string)

matchCriteriaId : 3D61E5F0-5F16-489D-BB7D-2C630637DCAC (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:* (string)

matchCriteriaId : D91F9D76-39D6-4D5E-BFAE-892CB8C30A79 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. (string)

}

1 : { »

lang : es (string)

value : SAP NetWeaver Enterprise Portal - versiones 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado (string)

}

]

id : CVE-2022-35172 (string)

lastModified : 2024-11-21T07:10:51.977 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-07-12T21:15:10.913 (string)

references : [ »

0 : { »

source : cna@sap.com (string)

tags : [ »

0 : Permissions Required (string)

1 : Vendor Advisory (string)

]

url : https://launchpad.support.sap.com/#/notes/3207902 (string)

}

1 : { »

source : cna@sap.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

1 : Vendor Advisory (string)

]

url : https://launchpad.support.sap.com/#/notes/3207902 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

sourceIdentifier : cna@sap.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : cna@sap.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object