CVE-2024-42374highCWE-91

CVE-2024-42374: high-severity vulnerability in SAP_SE SAP BEx Web Java Runtime Export Web…

XML injection in SAP BEx Web Java Runtime Export Web Service

Published · Updated

Follow this CVE+ Monitor SAP BEx Web Java Runtime Export Web Service

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.5%
BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected products
SAP_SE · SAP BEx Web Java Runtime Export Web Service