Untrusted XML Document Validation Vulnerability Affects SAP ADS Rendering
CVE-2024-42374

8.2HIGH

Key Information:

Vendor
SAP
Status
SAP Bex Web Java Runtime Export Web Service
Vendor
CVE Published:
13 August 2024

Summary

The BEx Web Java Runtime Export Web Service from SAP exhibits inadequate validation of XML documents received from untrusted sources. This vulnerability enables attackers to extract sensitive information from SAP ADS systems. Additionally, it can lead to the exhaustion of the XMLForm service, resulting in the inaccessibility of PDF creation functionalities, ultimately compromising the confidentiality and availability of applications relying on this service.

Affected Version(s)

SAP BEx Web Java Runtime Export Web Service BI-BASE-E 7.5

SAP BEx Web Java Runtime Export Web Service BI-BASE-B 7.5

SAP BEx Web Java Runtime Export Web Service BI-IBC 7.5

References

https://me.sap.com/notes/3485284
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.