CVE-2022-28215 Open redirect in SAP NetWeaver ABAP Server and ABAP Platform
An unauthenticated attacker can redirect users to malicious sites via insufficient URL validation, potentially tricking them into disclosing personal information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-28215?
CVE-2022-28215 is a medium-severity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.
Weakness: CWE-601
Which versions are affected by CVE-2022-28215?
It affects 1 product.
Products include Sap Netweaver Abap.
How do I fix CVE-2022-28215?
No fix has been published for CVE-2022-28215 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-28215 being exploited?
There is no known exploitation of CVE-2022-28215 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver ABAP Server and ABAP Platform
- CVE-2012-4341 Memory corruption in n/a
- CVE-2021-27610 Auth bypass in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-38178 Business logic in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2022-22543 Denial of service in SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)
- CVE-2021-38181 Denial of service in SAP NetWeaver AS ABAP and ABAP Platform
Sources
Also known as GHSA-8rrr-f77p-65qc.