Description
Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality and integrity of the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP | NetWeaver AS for Java (Http Provider Service) | 7.50 | — |
Advisories 2
- WID-SEC-2022-2290 SAP Patchday Dezember 2022 BSI CERT-Bund (WID) · May 31, 2023
- WID-SEC-2023-0356 SAP Software: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 13, 2023