CVE-2022-29610

Опубликовано: 11 мая 2022

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack.

Ссылки

https://launchpad.support.sap.com/#/notes/3146336
Permissions Required
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory
https://launchpad.support.sap.com/#/notes/3146336
Permissions Required
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.0037

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-6v7v-r44c-cv8w