CVE-2017-16349

HIGH

8.1

Description

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published8/2/2018

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

sap:business_planning_and_consolidation

Weaknesses (CWE)

CWE-611

References

https://www.talosintelligence.com/vulnerability_reports/SAP(talos-cna@cisco.com)

https://www.talosintelligence.com/vulnerability_reports/SAP(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.