Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system?s Availability by causing system to crash.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3148377 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Jul 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system?s Availability by causing system to crash. |
27 Jun 2022, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.20:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:* |
|
| CWE | CWE-918 | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
| First Time |
Sap
Sap netweaver |
|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3148377 - Permissions Required, Vendor Advisory | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory |
13 Jun 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-13 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-28217
Mitre link : CVE-2022-28217
CVE.ORG link : CVE-2022-28217
JSON object : View
Products Affected
sap
- netweaver
CWE
CWE-918
Server-Side Request Forgery (SSRF)