CVE-2022-41215

2022-11-0822:15:19

CWE-601

[email protected]

web.nvd.nist.gov

sap

netweaver

abap

platform

url validation

security issue

personal information

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS

0.001

Percentile

35.5%

JSON

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.

Affected configurations

Nvd

Node

sapnetweaver_application_server_abapMatch700

sapnetweaver_application_server_abapMatch731

sapnetweaver_application_server_abapMatch740

sapnetweaver_application_server_abapMatch750

sapnetweaver_application_server_abapMatch789

VendorProductVersionCPE
sapnetweaver_application_server_abap700cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
sapnetweaver_application_server_abap731cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*
sapnetweaver_application_server_abap740cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*
sapnetweaver_application_server_abap750cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*
sapnetweaver_application_server_abap789cpe:2.3:a:sap:netweaver_application_server_abap:789:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver_application_server_abap	700	cpe:2.3:a:sap:netweaver_application_server_abap:700:::::::*
sap	netweaver_application_server_abap	731	cpe:2.3:a:sap:netweaver_application_server_abap:731:::::::*
sap	netweaver_application_server_abap	740	cpe:2.3:a:sap:netweaver_application_server_abap:740:::::::*
sap	netweaver_application_server_abap	750	cpe:2.3:a:sap:netweaver_application_server_abap:750:::::::*
sap	netweaver_application_server_abap	789	cpe:2.3:a:sap:netweaver_application_server_abap:789:::::::*