CVE-2022-39799

CVE-2022-39799

Vendor Sap Se
Product SAP NetWeaver AS ABAP (SAP GUI for HTML within the Fiori Launchpad)
Weakness CWE-79 · XSS
Published September 13, 2022
Last update June 10, 2025

CVSS base score

What the vulnerability does

01Description

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user.

Key dates

02Disclosure timeline

September 13, 2022 CVE published
June 10, 2025 Record updated