VDB
CVE-2022-28217
CVE-2022-28217
PUBLISHED
Reported by sap · Published June 13, 2022
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver (EP Web Page Composer) | 7.20, 7.30, 7.31 |
| SAP SE | SAP NetWeaver (EP Web Page Composer) | 7.31, 7.40, 7.50 |
Timeline
- Apr 7, 2022 PoC Published (4 in total, the first dated here)
- Apr 13, 2022 CVE Published
- Jun 14, 2022 EPSS Score (30 in total, the first dated here)
- Apr 3, 2026 Security Advisory
- Jun 28, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-28217
vulnetix vdb fixes CVE-2022-28217Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-28217/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart