VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Sep 13, 2022· Updated Jun 17, 2026

CVE-2022-39799

CVE-2022-39799

Description

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user.

Affected products

7
  • SAP/NetWeaver Application Server for ABAP5 versions
    cpe:2.3:a:sap:netweaver_application_server_abap:7.54:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:sap:netweaver_application_server_abap:7.54:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:7.89:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:*
  • SAP/SAP GUI for HTMLllm-fuzzy
  • SAP SE/SAP NetWeaver AS ABAP (SAP GUI for HTML within the Fiori Launchpad)v5
    Range: KERNEL 7.77

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.