CVE-2024-47582CWE-611

XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA

Medium · published December 10, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.3th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2024-12-10T00:12Z
EPSS history
Timeline
  • 10 DEC 00:12Z
    XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
    cvelistv5