CVE-2024-47582
XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 10, 2024
- Updated
- Dec 10, 2024
- Reserved
- Sep 27, 2024
Description
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | sap |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
SAP NetWeaver AS JAVASAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.