CVE-2022-35227

A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site (XSS) scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to stealing or modifying of authentication information of the user, such as data relating to his or her current session.

• CWE-79

• https://launchpad.support.sap.com/#/notes/3211760Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://launchpad.support.sap.com/#/notes/3211760Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Jul 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35221Teamplus Pro community discussion has an ‘allocation of reso…5.4
• CVE-2022-35222HiCOS Citizen verification component has a stack-based buffe…6.8
• CVE-2022-35223EasyUse MailHunter Ultimate’s cookie deserialization functio…9.8
• CVE-2022-35224SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.3…6.1
• CVE-2022-35225SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20,…6.1
• CVE-2022-35226SAP Data Services Management allows an attacker to copy the …6.1
• CVE-2022-35228SAP BusinessObjects CMC allows an unauthenticated attacker t…8.8
• CVE-2022-35229An authenticated user can create a link with reflected Javas…5.4
• CVE-2022-3523A vulnerability was found in Linux Kernel. It has been class…5.3
• CVE-2022-35230An authenticated user can create a link with reflected Javas…5.4
• CVE-2022-35234Trend Micro Security 2021 and 2022 (Consumer) is vulnerable …7.1
• CVE-2022-35235Authenticated (admin+) Arbitrary File Read vulnerability in …4.9