CVE-2022-28770

MEDIUM

SAPUI5 library (vbm) 750, 753, 754, 755, 75 - Unauthenticated Cross-Site Scripting via URL Injection

Title source: llm
STIX 2.1

Description

Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/3126557

Scores

CVSS v3 6.1
EPSS 0.0073
EPSS Percentile 72.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (6)
sap/sapui5_library 200
sap/sapui5_library 750
sap/sapui5_library 753
sap/sapui5_library 754
sap/sapui5_library 755
sap/sapui5_library 756
Published Apr 12, 2022
Tracked Since Feb 18, 2026