Medium severity · published Oct 11, 2022
CVE-2022-35226
SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting…
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pages are vulnerable in the DS management console.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
SAP Data Services Management Console · SAP SE
4.2; 4.3 · source: vendor
DS
Data Services · Sap
4.2; 4.3 · source: NVD
Affected product
SD
SAP Data Services Management Console
SAP SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-35226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-35226
Permissions Required
https://launchpad.support.sap.com/#/notes/3167342
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP Data Services Management Console
3.7
CVE-2026-44762
Security Misconfiguration in SAP Data Services Management Console