SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its standard controls. This output encoding prevents stored malicious user input from being executed when it is reflected in the UI.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3124597 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035 | Vendor Advisory |
Configurations
History
10 Jul 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its standard controls. This output encoding prevents stored malicious user input from being executed when it is reflected in the UI. |
Information
Published : 2022-01-14 20:15
Updated : 2024-02-28 18:48
NVD link : CVE-2022-22529
Mitre link : CVE-2022-22529
CVE.ORG link : CVE-2022-22529
JSON object : View
Products Affected
sap
- enterprise_threat_detection
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')