SAP NetWeaver KMC-CMに任意コード実行の脆弱性
Summary
SAP NetWeaver Knowledge Management（XML Forms）のKMC-CM 7.50で、任意のコードが実行されうる脆弱性が公表されました。CVSS v3は9.9です。利用中の企業はSAP Note 3809153で該当を確認し、修正を適用してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
SAP NetWeaver Knowledge Management（XML Forms）のKMC-CM 7.50で、任意のコードが実行されうる脆弱性が公表されました。CVSS v3は9.9です。利用中の企業はSAP Note 3809153で該当を確認し、修正を適用してください。
Original description The description as published by the source.
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web cna@sap.com
- web cna@sap.com
- web nvd.nist.gov
- web github.com