Log in Start free

Vulnerability · Published Aug 13, 2024 · Assigned by sap

CVE-2024-42374XML injection in SAP BEx Web Java Runtime Export Web Service

High 8.2

In plain English

A high-severity security flaw in SAP BEx Web Java Runtime Export Web Service from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP BEx Web Java Runtime Export Web Service BI-BASE-E 7.5BI-BASE-B 7.5BI-IBC 7.5BI-BASE-S 7.5BIWEBAPP 7.5

Weakness: CWE-91 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References