CVE-2022-22546: 
SAP BusinessObjects Web Intelligence vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in SAP Business Objects Web Intelligence (BI Launchpad) version 420, identified as CVE-2022-22546. The vulnerability was disclosed on February 9, 2022, and stems from improper HTML encoding in input control summary (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires user interaction, has changed scope, and can impact both confidentiality and integrity with low severity, while having no impact on availability (NVD).

The vulnerability allows an authorized attacker to execute cross-site scripting attacks through improper HTML encoding in input control summary. Successful exploitation could lead to unauthorized access to sensitive information and potential manipulation of web content (AttackerKB).

The vulnerability requires an authorized attacker (low privileges) and user interaction to be exploited. The attack vector is network-based, making it remotely exploitable, though the requirement for authentication and user interaction somewhat limits its exploitability (NVD).

SAP has released security patches to address this vulnerability. Organizations using SAP Business Objects Web Intelligence (BI Launchpad) version 420 should apply the available security updates (SAP Advisory).