CVE-2024-42374

XML injection in SAP BEx Web Java Runtime Export Web Service

State: Published
Severity: 8.2 High
Published: Aug 13, 2024
Updated: Aug 14, 2024
Reserved: Jul 31, 2024

Description

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	sap

Weaknesses

CWE-91 XML Injection

Affected Products

Product	Versions
SAP BEx Web Java Runtime Export Web ServiceSAP_SE	BI-BASE-E 7.5Affected BI-BASE-B 7.5Affected BI-IBC 7.5Affected BI-BASE-S 7.5Affected BIWEBAPP 7.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.