Medium severity6.1NVD Advisory· Published Jun 14, 2022· Updated Jun 17, 2026
CVE-2022-29618
CVE-2022-29618
Description
Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to inject script into the URL and execute code in the user’s browser. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
Affected products
6cpe:2.3:a:sap:netweaver_development_infrastructure:7.30:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:sap:netweaver_development_infrastructure:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_development_infrastructure:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_development_infrastructure:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_development_infrastructure:7.50:*:*:*:*:*:*:*
- (no CPE)range: 7.30, 7.31, 7.40, 7.50
- SAP SE/SAP NetWeaver Development Infrastructure (Design Time Repository)v5Range: 7.30
Patches
Vulnerability mechanics
References
2- launchpad.support.sap.comnvdPermissions RequiredVendor Advisory
- www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.