SAP security note 2398144, "Missing XML Validation vulnerability in SAP Business Objects Titan", released on July 11, 2017. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Business Objects Titan does not sufficiently validate an XML document accepted from an untrusted source.
Some well-known impacts of the Missing XML Validation vulnerability include:
- Arbitrary file retrieval from the server
- Denial-of-service conditions in successful exploits
Solution
The SOAP-based web services will now use the AXIS 1.6.2 framework. This issue is fixed in the patches listed in the Support Packages & Patches section.
For the Business Intelligence Platform maintenance schedule and strategy, refer to SAP Note 2144559.
CVSS
Score 5.4
References
Full note on SAP: SAP Support Launchpad note 2398144
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].