CVE-2022-35297

2022-10-1100:00:00

CWE-79

sap

www.cve.org

sap enable now

stored cross-site scripting

xss

confidentiality

integrity

availability

0.001 Low

EPSS

Percentile

22.9%

JSON

The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited impact on Confidentiality, Integrity and Availability.

CNA Affected

[
  {
    "vendor": "SAP SE",
    "product": "SAP Enable Now",
    "versions": [
      {
        "version": "10",
        "status": "affected"
      }
    ]
  }
]