CVE-2022-28213

Katalog CVE

CVSS 8.1 · High EPSS 12,5%

Kerentanan Missing XML Validation pada sap businessobjects business intelligence platform. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.

Rincian

Terbit di NVD

12 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-112: Missing XML Validation

EPSS (30 hari)

12,5% peluang dieksploitasi; lebih tinggi dari 96,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://launchpad.support.sap.com/#/notes/3055044 permissions required · advisory vendor
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor
• http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html exploit · advisory pihak ketiga · vdb entry