XML External Entity Vulnerability in SAP NetWeaver AS JAVA
CVE-2017-11457
6.5MEDIUM
What is CVE-2017-11457?
An XML external entity (XXE) vulnerability exists in the com.sap.km.cm.ice component of SAP NetWeaver AS JAVA 7.5. This flaw allows remote authenticated users to exploit the system to read arbitrary files and perform server-side request forgery (SSRF) attacks by crafting a malicious Document Type Definition (DTD) within an XML request. This vulnerability can lead to significant security risks, as unauthorized access to system files and internal resources can potentially be misused.