CVE-2024-42374

Aug. 13, 2024, 12:58 p.m.

8.2
High

Description

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

Product(s) Impacted

Product Versions
SAP NetWeaver

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-91
XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References

https://me.sap.com/notes/3485284
https://url.sap/sapsecuritypatchday

Tags

CWE-91
cna@sap.com
2024-08-13
CVE-2024-42374

CVSS Score

8.2 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

    View Vector String

Timeline

Published: Aug. 13, 2024, 4:15 a.m.
Last Modified: Aug. 13, 2024, 12:58 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@sap.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.