« Volver al listado

CVE-2022-28770

Estado: ModificadaMedia (6.1)—

Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Sapui5 Library

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-28770",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAPUI5 (vbm library)",
          "versions": [
            {
              "status": "affected",
              "version": "750"
            },
            {
              "status": "affected",
              "version": "753"
            },
            {
              "status": "affected",
              "version": "754"
            },
            {
              "status": "affected",
              "version": "755"
            },
            {
              "status": "affected",
              "version": "756"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-12T17:15:10.777",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3126557",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3126557",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application."
    },
    {
      "lang": "es",
      "value": "Debido a una insuficiente comprobación de entrada, la biblioteca SAPUI5(vbm) - versiones 750, 753, 754, 755, 75, permite a un atacante no autenticado inyectar un script en la URL y ejecutar código. Si es explotado con éxito, un atacante puede visualizar o modificar información causando un impacto limitado en la confidencialidad e integridad de la aplicación"
    }
  ],
  "lastModified": "2026-06-17T04:38:59.627",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:sapui5_library:200:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "908AEBD9-275D-4258-A4EA-FA7C8A8817DA"
            },
            {
              "criteria": "cpe:2.3:a:sap:sapui5_library:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2511B513-C304-44B1-BD9E-2EB198EB4237"
            },
            {
              "criteria": "cpe:2.3:a:sap:sapui5_library:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DA13545-D3EA-46EF-AF71-1A33C4C46CD7"
            },
            {
              "criteria": "cpe:2.3:a:sap:sapui5_library:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52173270-0D45-4DB3-8751-881B0E3417FE"
            },
            {
              "criteria": "cpe:2.3:a:sap:sapui5_library:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "998695F3-B83D-4C99-95FF-4DAABD722413"
            },
            {
              "criteria": "cpe:2.3:a:sap:sapui5_library:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04796435-0E1A-4582-8996-5818E7F49418"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}