The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

A cross site scripting vulnerability exists in SAP NetWeaver AS Java versions 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, and 8.04 which may allow an unauthenticated attacker to steal authentication information of the user.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2022-27656

medium

Tenable Plugins

medium