CVE-2022-28217

State: Published
Severity: Not scored
Published: Jun 13, 2022
Updated: Aug 3, 2024
Reserved: Mar 30, 2022

Description

Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.

Scores

The record has no CVSS score.

Weaknesses

CWE-918

Affected Products

Product	Versions
SAP NetWeaver (EP Web Page Composer)SAP SE	7.20Affected 7.30Affected 7.31Affected 7.40Affected 7.50Affected

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://launchpad.support.sap.com/#/notes/3148377

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.