CVE-2022-24397

SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.This reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content of portal Website. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser.

• CWE-79

• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3146260Permissions Required, Vendor Advisory
• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3146260Permissions Required, Vendor Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24391Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24392Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24393Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24394Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24395SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20,…6.1
• CVE-2022-24396The Simple Diagnostics Agent - versions 1.0 up to version 1.…7.8
• CVE-2022-24398Under certain conditions SAP Business Objects Business Intel…6.5
• CVE-2022-24399The SAP Focused Run (Real User Monitoring) - versions 200, 3…6.1
• CVE-2022-2440The Theme Editor plugin for WordPress is vulnerable to deser…7.2
• CVE-2022-24400A flaw in the TETRA authentication procecure allows a MITM a…5.9
• CVE-2022-24401Adversary-induced keystream re-use on TETRA air-interface en…8.1
• CVE-2022-24402The TETRA TEA1 keystream generator implements a key register…7.5