high8.1Public exploit code
CVE-2022-28213
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML docume…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)2022-05-11 · remote · multiple
Impact
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Businessobjects Business Intelligence Platform | Versions 420, 430 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html
- https://launchpad.support.sap.com/#/notes/3055044
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html
- https://launchpad.support.sap.com/#/notes/3055044
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html