6.4med
CVE-2017-16349
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.4
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known
Summary
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.
Exploit prediction (EPSS)
1.19% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| CNA | 3.0 | 6.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:N/A:P |
Affected products
- Insteon SAP
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- talosintelligence.com /vulnerability_reports/SAP · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-16349
- NVD: CVE-2017-16349
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.