Vulnerability-Lookup

CVE-2022-27656 (GCVE-0-2022-27656)

Vulnerability from cvelistv5 – Published: 2022-05-11 14:53 – Updated: 2024-08-03 05:32

Summary

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Assigner

sap CNA under the mitre root

CNA scorecard C 65/100 over 117 records in the last 180 days details

References

2 references

URL	Tags
https://www.sap.com/documents/2022/02/fa865ea4-16…	x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3145046	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
SAP SE	SAP NetWeaver AS for ABAP and Java (ICM Administration UI)	Affected: KRNL64NUC 7.22 Affected: 7.22EXT Affected: 7.49 Affected: KRNL64 8.04 Affected: 7.22 Affected: 7.53 Affected: KERNEL 7.22 Affected: 8.04 Affected: 7.77 Affected: 7.81 Affected: 7.85 Affected: 7.86 Affected: 7.87	guessed
SAP SE	SAP Web Dispatcher (Web Administration UI)	Affected: 7.49 Affected: 7.53 Affected: 7.77 Affected: 7.81 Affected: 7.85 Affected: 7.22_EXT	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:32:59.822Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3145046"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver AS for ABAP and Java (ICM Administration UI)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "KRNL64 8.04"
            },
            {
              "status": "affected",
              "version": "7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.86"
            },
            {
              "status": "affected",
              "version": "7.87"
            }
          ]
        },
        {
          "product": "SAP Web Dispatcher (Web Administration UI)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.22_EXT"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-11T14:53:54.000Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3145046"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-27656",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver AS for ABAP and Java (ICM Administration UI)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "KRNL64NUC 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22EXT"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "KRNL64 8.04"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22EXT"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "KERNEL 7.22"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.04"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.77"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.81"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.85"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.86"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.87"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP Web Dispatcher (Web Administration UI)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.49"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.53"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.77"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.81"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.85"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.22_EXT"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3145046",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3145046"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2022-27656",
    "datePublished": "2022-05-11T14:53:55.000Z",
    "dateReserved": "2022-03-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T05:32:59.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-27656",
      "date": "2026-10-25",
      "epss": "0.00568",
      "percentile": "0.46779"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "SAP NetWeaver AS for ABAP and Java (ICM Administration UI)",
                "vendor": "SAP SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "KRNL64NUC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.22EXT"
                  },
                  {
                    "status": "affected",
                    "version": "7.49"
                  },
                  {
                    "status": "affected",
                    "version": "KRNL64 8.04"
                  },
                  {
                    "status": "affected",
                    "version": "7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.53"
                  },
                  {
                    "status": "affected",
                    "version": "KERNEL 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "8.04"
                  },
                  {
                    "status": "affected",
                    "version": "7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.81"
                  },
                  {
                    "status": "affected",
                    "version": "7.85"
                  },
                  {
                    "status": "affected",
                    "version": "7.86"
                  },
                  {
                    "status": "affected",
                    "version": "7.87"
                  }
                ]
              },
              {
                "product": "SAP Web Dispatcher (Web Administration UI)",
                "vendor": "SAP SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.49"
                  },
                  {
                    "status": "affected",
                    "version": "7.53"
                  },
                  {
                    "status": "affected",
                    "version": "7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.81"
                  },
                  {
                    "status": "affected",
                    "version": "7.85"
                  },
                  {
                    "status": "affected",
                    "version": "7.22_EXT"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.22:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE603A80-8FF0-4180-9E11-C468AE2441C7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.49:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EDCE6828-68FD-44F0-9F82-FE4F92837E71",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.53:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7EB97250-22A3-4BA6-8498-59ED0E81E3CC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.77:*:*:*:*:*:*:*",
                    "matchCriteriaId": "50570852-982E-40CA-B391-3FB8B9373F78",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.81:*:*:*:*:*:*:*",
                    "matchCriteriaId": "246E9B6B-2480-460B-9428-2CC278D2D07B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.85:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D3407E01-921F-4067-AAF7-5A1269A24F5D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.86:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EAF27F3E-DF2B-4C76-9044-8CDC8C47C2B6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.87:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6827BA02-43E0-4CEF-B556-A990414AF47E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:8.04:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5CCE264A-51E5-4C30-834E-D2E0F24264A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B5E3292A-7311-4821-A52E-8FB4A1449D44",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22ext:*:*:*:*:*:*:*",
                    "matchCriteriaId": "171A52A4-8383-47D9-89D4-FC44CA84DA49",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.49:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5F1FEA71-D53B-4520-AE06-60D337ACA177",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.53:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1190FF1-8D50-4424-AE21-6AE562D5C6B1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:8.04:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75C8A6AE-7F73-4FE7-B2A0-1487BBE7DC1B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.22ext:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A23C8F80-DAA8-4A22-94A6-05964069FF81",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.49:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2784A91C-D32C-4F1A-8C71-E2DB7539D762",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.53:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7971FCDA-2BEF-4F68-A299-FE7800E65603",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.77:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DE74783C-4430-4317-962A-2FEA43B5E44A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.81:*:*:*:*:*:*:*",
                    "matchCriteriaId": "14601342-6FEB-40A6-9778-E729B8718790",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.83:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F1CEE97-1C0D-4571-8666-77E68CCBE7CB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:webdispatcher:7.85:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3D980C45-E535-4662-A250-DCDD53631835",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability."
          },
          {
            "lang": "es",
            "value": "La interfaz de administraci\u00f3n web de SAP Web Dispatcher y de Internet Communication Manager (ICM) no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS)"
          }
        ],
        "id": "CVE-2022-27656",
        "lastModified": "2026-06-17T04:37:26.087",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-05-11T15:15:09.677",
        "references": [
          {
            "source": "cna@sap.com",
            "tags": [
              "Permissions Required",
              "Vendor Advisory"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3145046"
          },
          {
            "source": "cna@sap.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Permissions Required",
              "Vendor Advisory"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3145046"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T12:35:27+00:00",
      "cve": "CVE-2022-27656",
      "id": "CVE-2022-27656",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2022-27656",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-27656.json",
      "version": "3"
    }
  }
}

CERTFR-2022-AVI-456

Vulnerability from certfr_avis - Published: 2022-05-12 - Updated: 2022-05-12

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
SAP	N/A	SAP Customer Profitability Analytics version 2
SAP	N/A	SAP Netweaver AS for ABAP and Java (ICM) versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, 8.04, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 8.04
SAP	N/A	SAP NetWeaver Application Server ABAP versions 753, 754, 755 et 756
SAP	N/A	SAP Business One Cloud version 1.1
SAP	N/A	SAP NetWeaver and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 et 7.8
SAP	N/A	SAP Webdispatcher versions 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.83 et 7.85
SAP	SAP BusinessObjects Business Intelligence	SAP BusinessObjects Business Intelligence Platform versions 420 et 430
SAP	N/A	SAP Commerce versions 1905, 2005, 2105 et 2011
SAP	N/A	SAP Employee Self Service (Fiori My Leave Request) version 605
SAP	N/A	SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750 et 787
SAP	N/A	SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 et 788
SAP	N/A	SAP NetWeaver (ABAP and Java application Servers) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 756
SAP	N/A	SAP Host Agent version 7.22

References

Title

Publication Time

FKIE_CVE-2022-27656

Vulnerability from fkie_nvd - Published: 2022-05-11 15:15 - Updated: 2026-06-17 04:37

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
cna@sap.com	https://launchpad.support.sap.com/#/notes/3145046	Permissions Required, Vendor Advisory
cna@sap.com	https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://launchpad.support.sap.com/#/notes/3145046	Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Impacted products

Vendor	Product	Version
sap	netweaver_as_abap_kernel	7.22
sap	netweaver_as_abap_kernel	7.49
sap	netweaver_as_abap_kernel	7.53
sap	netweaver_as_abap_kernel	7.77
sap	netweaver_as_abap_kernel	7.81
sap	netweaver_as_abap_kernel	7.85
sap	netweaver_as_abap_kernel	7.86
sap	netweaver_as_abap_kernel	7.87
sap	netweaver_as_abap_kernel	8.04
sap	netweaver_as_abap_krnl64uc	7.22
sap	netweaver_as_abap_krnl64uc	7.22ext
sap	netweaver_as_abap_krnl64uc	7.49
sap	netweaver_as_abap_krnl64uc	7.53
sap	netweaver_as_abap_krnl64uc	8.04
sap	webdispatcher	7.22ext
sap	webdispatcher	7.49
sap	webdispatcher	7.53
sap	webdispatcher	7.77
sap	webdispatcher	7.81
sap	webdispatcher	7.83
sap	webdispatcher	7.85

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "SAP NetWeaver AS for ABAP and Java (ICM Administration UI)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "KRNL64 8.04"
            },
            {
              "status": "affected",
              "version": "7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.86"
            },
            {
              "status": "affected",
              "version": "7.87"
            }
          ]
        },
        {
          "product": "SAP Web Dispatcher (Web Administration UI)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.22_EXT"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE603A80-8FF0-4180-9E11-C468AE2441C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.49:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDCE6828-68FD-44F0-9F82-FE4F92837E71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.53:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EB97250-22A3-4BA6-8498-59ED0E81E3CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.77:*:*:*:*:*:*:*",
              "matchCriteriaId": "50570852-982E-40CA-B391-3FB8B9373F78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.81:*:*:*:*:*:*:*",
              "matchCriteriaId": "246E9B6B-2480-460B-9428-2CC278D2D07B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.85:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3407E01-921F-4067-AAF7-5A1269A24F5D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.86:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAF27F3E-DF2B-4C76-9044-8CDC8C47C2B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.87:*:*:*:*:*:*:*",
              "matchCriteriaId": "6827BA02-43E0-4CEF-B556-A990414AF47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:8.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CCE264A-51E5-4C30-834E-D2E0F24264A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5E3292A-7311-4821-A52E-8FB4A1449D44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22ext:*:*:*:*:*:*:*",
              "matchCriteriaId": "171A52A4-8383-47D9-89D4-FC44CA84DA49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.49:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F1FEA71-D53B-4520-AE06-60D337ACA177",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.53:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1190FF1-8D50-4424-AE21-6AE562D5C6B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:8.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "75C8A6AE-7F73-4FE7-B2A0-1487BBE7DC1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.22ext:*:*:*:*:*:*:*",
              "matchCriteriaId": "A23C8F80-DAA8-4A22-94A6-05964069FF81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.49:*:*:*:*:*:*:*",
              "matchCriteriaId": "2784A91C-D32C-4F1A-8C71-E2DB7539D762",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.53:*:*:*:*:*:*:*",
              "matchCriteriaId": "7971FCDA-2BEF-4F68-A299-FE7800E65603",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.77:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE74783C-4430-4317-962A-2FEA43B5E44A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.81:*:*:*:*:*:*:*",
              "matchCriteriaId": "14601342-6FEB-40A6-9778-E729B8718790",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.83:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F1CEE97-1C0D-4571-8666-77E68CCBE7CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:webdispatcher:7.85:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D980C45-E535-4662-A250-DCDD53631835",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability."
    },
    {
      "lang": "es",
      "value": "La interfaz de administraci\u00f3n web de SAP Web Dispatcher y de Internet Communication Manager (ICM) no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS)"
    }
  ],
  "id": "CVE-2022-27656",
  "lastModified": "2026-06-17T04:37:26.087",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-05-11T15:15:09.677",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3145046"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3145046"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JC59-RWRG-X5XH

Vulnerability from github – Published: 2022-05-12 00:01 – Updated: 2022-05-20 00:00

Details

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-27656"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-11T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.",
  "id": "GHSA-jc59-rwrg-x5xh",
  "modified": "2022-05-20T00:00:30Z",
  "published": "2022-05-12T00:01:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27656"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3145046"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-27656

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-27656

Aliases

CVE-2022-27656

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-27656",
    "description": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.",
    "id": "GSD-2022-27656"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-27656"
      ],
      "details": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.",
      "id": "GSD-2022-27656",
      "modified": "2023-12-13T01:19:40.692308Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@sap.com",
        "ID": "CVE-2022-27656",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "SAP NetWeaver AS for ABAP and Java (ICM Administration UI)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "KRNL64NUC 7.22"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.22EXT"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.49"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "KRNL64 8.04"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.22"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.22EXT"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.49"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.53"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "KERNEL 7.22"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "8.04"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.49"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.53"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.77"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.81"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.85"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.86"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.87"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "SAP Web Dispatcher (Web Administration UI)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "7.49"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.53"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.77"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.81"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.85"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.22_EXT"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "SAP SE"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability."
          }
        ]
      },
      "impact": {
        "cvss": {
          "baseScore": "null",
          "vectorString": "null",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-79"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
            "refsource": "MISC",
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "name": "https://launchpad.support.sap.com/#/notes/3145046",
            "refsource": "MISC",
            "url": "https://launchpad.support.sap.com/#/notes/3145046"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:8.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22ext:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.53:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:8.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.53:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.77:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.81:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.85:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.86:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.87:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.53:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.77:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.81:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.83:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.85:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:webdispatcher:7.22ext:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2022-27656"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://launchpad.support.sap.com/#/notes/3145046",
              "refsource": "MISC",
              "tags": [
                "Permissions Required",
                "Vendor Advisory"
              ],
              "url": "https://launchpad.support.sap.com/#/notes/3145046"
            },
            {
              "name": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2022-05-19T17:49Z",
      "publishedDate": "2022-05-11T15:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-27656 (GCVE-0-2022-27656)

CERTFR-2022-AVI-456

Solution

FKIE_CVE-2022-27656

GHSA-JC59-RWRG-X5XH

GSD-2022-27656

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour