Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-35294

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP SE SAP NetWeaver AS ABAP

  • KRNL64NUC 7.22affected
  • 7.22EXTaffected
  • 7.49affected
  • KRNL64UC 7.22affected
  • 7.53affected
  • KERNEL 7.22affected
  • 7.77affected
  • 7.81affected
  • 7.85affected
  • 7.89affected
  • 7.54affected

References