CVE Vulnerabilities

CVE-2022-28213

Missing XML Validation

Published: Apr 12, 2022 | Modified: Sep 09, 2022
CVSS 3.x
8.1
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.x
5.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.

Weakness

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

Affected Software

Name Vendor Start Version End Version
Businessobjects_business_intelligence_platform Sap 420 420
Businessobjects_business_intelligence_platform Sap 430 430

Potential Mitigations

  • Always validate XML input against a known XML Schema or DTD.
  • It is not possible for an XML parser to validate all aspects of a document’s content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document’s structure and therefore guarantee to the code that processes the document that the content is well-formed.

References