CVE-2022-27656

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS for ABAP and Java (ICM Administration UI)	KRNL64NUC 7.22; 7.22EXT; 7.49; KRNL64 8.04; 7.22; 7.53; KERNEL 7.22; 8.04; 7.77; 7.81; 7.85; 7.86; 7.87
SAP SE	SAP Web Dispatcher (Web Administration UI)	7.49; 7.53; 7.77; 7.81; 7.85; 7.22_EXT

References

https://launchpad.support.sap.com/#/notes/3145046Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3145046Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-276572.7A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient v CVE-2022-276587.5Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information CVE-2022-276594.3On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated a CVE-2022-27669.8A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown fu CVE-2022-276607.5A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially CVE-2022-276614.3Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the d CVE-2022-276624.8On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exi CVE-2022-276647.5In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang duri CVE-2022-276656.1Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of mali CVE-2022-276667.8A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local atta CVE-2022-276677.5Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attac CVE-2022-276689.8Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute