CVE-2022-22534 Cross-site scripting in SAP NetWeaver (ABAP and Java application Servers)
An unauthenticated attacker can inject code via insufficient encoding to expose sensitive data like user IDs and passwords in SAP NetWeaver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-22534?
CVE-2022-22534 is a medium-severity cross-site scripting vulnerability in Sap Netweaver, published on 9 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.
Weakness: CWE-79
Which versions are affected by CVE-2022-22534?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2022-22534?
No fix has been published for CVE-2022-22534 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-22534 being exploited?
There is no known exploitation of CVE-2022-22534 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-vr8v-ggvj-qc6m.