CVE-2024-24743CWE-611

XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)

High · published February 13, 2024

CVSS v3.1
8.6
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2024-02-13T02:43Z
EPSS history
Timeline
  • 13 FEB 02:43Z
    XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
    cvelistv5