Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing XML Validation vulnerability in Visual Composer VC70RUNTIME, SAP security note 2386873

SAP Note 2386873SAP Security NoteMedium priority

SAP security note 2386873, "Missing XML Validation vulnerability in Visual Composer VC70RUNTIME", is a program error note released on 14.02.2017. Below are the symptom and SAP recommended solution.

ComponentSAP Business Warehouse > Business Explorer > Universal Data Integration > Visual Composer BI Kit
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version4
StatusReleased for Customer
Released on14.02.2017
LanguageEnglish

Description

Symptom

VC70RUNTIME does not sufficiently validate an XML document accepted from an untrusted source.

Some well-known impacts of the Missing XML Validation vulnerability include:

  • Arbitrary files retrieval from the server
  • Denial-of-service conditions in successful exploits

Solution

Added validation to the accepted XML document and provided a security patch.

CVSS

Score 6.5

References

Full note on SAP: SAP Support Launchpad note 2386873

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XXE#XML Input Parsing#Visual Composer#VC70RUNTIME

Explore More