SAP BusinessObjectsにXXE脆弱性、修正を公開
Summary
SAP BusinessObjectsのWeb Intelligenceに、サーバー上のファイル読み取りや社内システムへの到達を許す脆弱性があります。ENTERPRISE 430・2025・2027の利用組織は、SAP Note 3799117で修正を確認し、早めに適用してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
SAP BusinessObjectsのWeb Intelligenceに、サーバー上のファイル読み取りや社内システムへの到達を許す脆弱性があります。ENTERPRISE 430・2025・2027の利用組織は、SAP Note 3799117で修正を確認し、早めに適用してください。
Original description The description as published by the source.
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web cna@sap.com
- web cna@sap.com
- web nvd.nist.gov
- web github.com