CVEvulnerability
CVE-2022-28213
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:P
- Weaknesses
- CWE-112
Description
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.
Affected configurations
• sap businessobjects business intelligence platform 420
• sap businessobjects business intelligence platform 430
Related
Weakness · CWE (1)
- CWE-112 Missing XML Validation weakness
References
- http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/3055044 Permissions Required, Vendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
- http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/3055044 Permissions Required, Vendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory