{"id":"CVE-2022-22534","state":"PUBLISHED","title":"Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoint","description":"Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.","publishedAt":"2022-02-09T22:05:21.000Z","updatedAt":"2024-08-03T03:14:55.475Z","severity":null,"assigner":"sap","products":["SAP SE SAP NetWeaver (ABAP and Java application Servers)"],"affected":[{"vendor":"SAP SE","product":"SAP NetWeaver (ABAP and Java application Servers)","versions":[{"version":"700","status":"affected"},{"version":"701","status":"affected"},{"version":"702","status":"affected"},{"version":"731","status":"affected"},{"version":"740","status":"affected"},{"version":"750","status":"affected"},{"version":"751","status":"affected"},{"version":"752","status":"affected"},{"version":"753","status":"affected"},{"version":"754","status":"affected"},{"version":"755","status":"affected"},{"version":"756","status":"affected"}]}],"references":["https://launchpad.support.sap.com/#/notes/3124994","https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:38.433Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/22xxx/CVE-2022-22534.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-22534","state":"PUBLISHED","datePublished":"2022-02-09T22:05:21.000Z","dateUpdated":"2024-08-03T03:14:55.475Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2022-01-04T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application."}],"affected":[{"vendor":"SAP SE","product":"SAP NetWeaver (ABAP and Java application Servers)","versions":[{"version":"700","status":"affected"},{"version":"701","status":"affected"},{"version":"702","status":"affected"},{"version":"731","status":"affected"},{"version":"740","status":"affected"},{"version":"750","status":"affected"},{"version":"751","status":"affected"},{"version":"752","status":"affected"},{"version":"753","status":"affected"},{"version":"754","status":"affected"},{"version":"755","status":"affected"},{"version":"756","status":"affected"}]}],"references":[{"url":"https://launchpad.support.sap.com/#/notes/3124994","tags":["x_refsource_MISC"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"Cross-Site Scripting","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"sap","dateUpdated":"2022-08-24T15:18:07.000Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2022-22534","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP NetWeaver (ABAP and Java application Servers)","version":{"version_data":[{"version_affected":"=","version_value":"700"},{"version_affected":"=","version_value":"701"},{"version_affected":"=","version_value":"702"},{"version_affected":"=","version_value":"731"},{"version_affected":"=","version_value":"740"},{"version_affected":"=","version_value":"750"},{"version_affected":"=","version_value":"751"},{"version_affected":"=","version_value":"752"},{"version_affected":"=","version_value":"753"},{"version_affected":"=","version_value":"754"},{"version_affected":"=","version_value":"755"},{"version_affected":"=","version_value":"756"}]}}]},"vendor_name":"SAP SE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application."}]},"impact":{"cvss":{"baseScore":"null","vectorString":"null","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Scripting"}]}]},"references":{"reference_data":[{"name":"https://launchpad.support.sap.com/#/notes/3124994","refsource":"MISC","url":"https://launchpad.support.sap.com/#/notes/3124994"},{"name":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","refsource":"MISC","url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://launchpad.support.sap.com/#/notes/3124994","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T03:14:55.475Z"}}]}}}