Medium severity · published Dec 10, 2024
CVE-2024-47582
XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS JAVA · SAP_SE
LM-CORE 7.50 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47582
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47582
me.sap.com
https://me.sap.com/notes/3351041
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver AS JAVA
7.5
CVE-2024-34688
Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
5.3
CVE-2024-28164
Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)