CVE-2022-28770

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP SE	SAPUI5 (vbm library)	750; 753; 754; 755; 756

References

https://launchpad.support.sap.com/#/notes/3126557Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3126557Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Apr 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-287717.5Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send maliciou CVE-2022-287727.5By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.CVE-2022-287737.5Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial CVE-2022-287745.5Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.CVE-2022-287753.3Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permi CVE-2022-287767.8Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store wi CVE-2022-287773.3Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without C CVE-2022-287783.3Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as CVE-2022-287797.8Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attack CVE-2022-287805.5Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that CVE-2022-287816.7Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. T CVE-2022-287824.6Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package befo