Vulnerability · Published Oct 11, 2022 · Assigned by sap
CVE-2022-35226
Medium 6.1
In plain English
A medium-severity cross-site scripting in SAP Data Services Management Console from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pages are vulnerable in the DS management console.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Data Services Management Console | 4.24.3 |
Weakness: CWE-79