SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pages are vulnerable in the DS management console.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3167342 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:48
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pages are vulnerable in the DS management console. |
Information
Published : 2022-10-11 21:15
Updated : 2024-02-28 19:29
NVD link : CVE-2022-35226
Mitre link : CVE-2022-35226
CVE.ORG link : CVE-2022-35226
JSON object : View
Products Affected
sap
- data_services
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')