XML External Entity Vulnerability in SAP Customer Relationship Management
CVE-2013-7095

Currently unrated

Key Information:

Vendor
SAP
Status
Customer Relationship Management
Vendor
CVE Published:
13 December 2013

Summary

The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 is susceptible to an XML External Entity (XXE) vulnerability. This issue allows attackers to exploit the XML parsing process, potentially leading to arbitrary file access or disclosure of sensitive information as the parser processes untrusted XML input. Proper input validation and document processing controls are crucial to mitigate the risks associated with this vulnerability.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/89703
vdb-entryx_refsource_XF
http://www.securitytracker.com/id/1029488
vdb-entryx_refsource_SECTRACK
http://scn.sap.com/docs/DOC-8218
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.