CVE-2022-27656 — Vulnetix

Try Vulnetix Request Demo

CVE-2022-27656 PUBLISHED CVSS 6.099999904632568 MEDIUM

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

EPSS 0.39% · 60.1th percentile

Risk Scores

CVSS v3.1

6.099999904632568

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

0.39%

60.1th percentile

Affected Products

Vendor	Product	Versions
sap	netweaver_as_abap_kernel	7.49, 7.53, 7.77
sap	netweaver_as_abap_krnl64uc	7.22ext, 7.49, 7.53
SAP SE	SAP Web Dispatcher (Web Administration UI)	7.53, 7.77, 7.81
SAP SE	SAP NetWeaver AS for ABAP and Java (ICM Administration UI)	KRNL64NUC 7.22, 7.22EXT, 7.49
sap	webdispatcher	7.22ext, 7.49, 7.53

Timeline

Apr 7, 2022 PoC Published
May 11, 2022 CVE Published
May 12, 2022 EPSS Score
Jun 30, 2022 EPSS Score
Aug 18, 2022 EPSS Score
Oct 6, 2022 EPSS Score
Nov 24, 2022 EPSS Score
Jan 11, 2023 EPSS Score
Mar 1, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 19, 2023 EPSS Score
Jun 6, 2023 EPSS Score

References

Open in Interactive Console →