CVE-2022-28213
high · 8.1When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.
8.1
CVSS
12.5%
EPSS (exploit prob.)
96th
EPSS percentile
2022-04-12
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-112
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sap | businessobjects_business_intelligence_platform | 420 |
| sap | businessobjects_business_intelligence_platform | 430 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html
- https://launchpad.support.sap.com/#/notes/3055044
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html
- https://launchpad.support.sap.com/#/notes/3055044
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-28213