CVE-2024-42374

Published: Aug 13, 2024Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Exploitability: 3.9 / Impact: 4.2

Source: NVD

Description

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

Affected (5)

Products: Sap: Bex Web Java Runtime Export Web Service

Sap

1 product

Bex Web Java Runtime Export Web Service

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Sap Bex Web Java Runtime Export Web Service	Version bi-base-b_7.5
Sap Bex Web Java Runtime Export Web Service	Version bi-base-e_7.5
Sap Bex Web Java Runtime Export Web Service	Version bi-base-s_7.5
Sap Bex Web Java Runtime Export Web Service	Version bi-ibc_7.5
Sap Bex Web Java Runtime Export Web Service	Version biwebapp_7.5

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

https://me.sap.com/notes/3485284

Source: cna@sap.com

Permissions Required

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

Vendor Advisory

Timeline

No history available yet.