CVE-2022-35294: SAP NetWeaver Application Server Abap

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.

Affected products

• SAP NetWeaver Application Server Abap: version 7.22ext only; version 7.49 only; version 7.53 only; version 7.54 only; version 7.77 only; version 7.81 only; …

Published 2022-09-13. Last modified 2026-06-17.