XML External Entity Vulnerability in SAP BusinessObjects Explorer by SAP

CVE-2014-8316

Summary

SAP BusinessObjects Explorer 14.0.5 build 882 contains an XML External Entity (XXE) vulnerability that enables remote attackers to exploit the xmlParameter parameter within an explorationSpaceUpdate request. This exploitation allows unauthorized access to read arbitrary files on the server, potentially exposing sensitive information and compromising the security of the system. By manipulating the XML input, attackers can gain access to the server's file system, increasing the risk of data breaches and other malicious activities.

References