SAP security note 2653519, "[CVE-2018-2416] Missing XML Validation vulnerability in SAP Identity Management". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Identity Management does not sufficiently validate an XML document accepted from an untrusted source.
Impacts of Missing XML Validation vulnerability include:
- Arbitrary file retrieval from the server
- Denial-of-service conditions in successful exploits
Solution
Apply the attached patch provided in the Support Packages & Patches section of this SAP Note. Ensure all components are updated to the corresponding Support Package level before applying the patch.
Reason and prerequisites
You are using SAP Identity Management 7.2.
CVSS
Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Full note on SAP: SAP Support Launchpad note 2653519
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
