Vulnerability Details CVE-2022-35225
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 55.9%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
Products affected by CVE-2022-35225
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.10
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.11
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.20
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.30
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.31
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.40
-
cpe:2.3:a:sap:netweaver_enterprise_portal:7.50