SAP Note 2406918
SAP security note 2406918, "Missing XML Validation vulnerability in SAP NetWeaver Web Services Configuration UI". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Web Services Configuration UI does not sufficiently validate an XML document accepted from an untrusted source.
Some well-known impacts of Missing XML Validation vulnerability are:
- Arbitrary files retrieval from the server
- Denial-of-service conditions in successful exploits
Solution
This issue is fixed with the Support Packages and Patches referenced by this SAP Note.
CVSS
Score 3.8 Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Affected components
- ESI-UI versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
Full note on SAP: SAP Support Launchpad note 2406918
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].