PT-2022-18878 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2022-04-12 · Updated 2022-09-09 · CVE-2022-28213

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions 420, 430

Description The issue arises when a user accesses SOAP Web services, and the system fails to sufficiently validate the XML document accepted from an untrusted source. This could lead to the retrieval of arbitrary files from the server and potentially result in successful exploits of Denial of Service (DoS).

Recommendations For versions 420 and 430, consider restricting access to SOAP Web services until a fix is available. As a temporary workaround, restrict the acceptance of XML documents from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-112

Related Identifiers

CVE-2022-28213

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 7

• 🔥 https://exploit-db.com/exploits/50900 · Exploit
• 🔥 http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.html · Exploit
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28213 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28213 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3055044 · Vendor Advisory
• https://t.me/cibsecurity/40660 · Telegram Post