SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting…

Published 8 y ago 2018-03-14 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.6%

percentile 76%

Public exploits

none known

SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.

Exploit prediction (EPSS)

1.59% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.4	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L`
CNA	3.0	5.4	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L`
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.5	`AV:N/AC:L/Au:S/C:P/I:P/A:P`

Affected products

SAP SE SAP Business Process Automation (BPA) By Redwood

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

launchpad.support.sap.com /#/notes/2596766 · x_refsource_CONFIRM, x_transferred
blogs.sap.com /2018/03/13/sap-security-patch-day-march-2018/ · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/103374 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2018-2401
NVD: CVE-2018-2401

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.