← Back

CVE-2022-28213

nvd nist
Published: Apr 12, 2022Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Exploitability: 2.8 / Impact: 5.2
Source: NVD

Description

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.

Affected (2)

Sap
1 product
Businessobjects Business Intelligence Platform
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Sap
Businessobjects Business Intelligence Platform
Version 420
Businessobjects Business Intelligence Platform
Version 430

Related CWEs

CWE-112
Missing XML Validation
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

References (6)

Source: cna@sap.com
ExploitThird Party AdvisoryVDB Entry
Source: cna@sap.com
Permissions RequiredVendor Advisory
Source: cna@sap.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.