VulnerabilityModified
CVE-2018-2401
SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.
HIGH 8.8EPSS 1.59%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.59% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- redwood/sap business process automation
- Source
- cna@sap.com
References
- http://www.securityfocus.com/bid/103374Third Party Advisory, VDB Entry
- https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2596766Permissions Required
- http://www.securityfocus.com/bid/103374Third Party Advisory, VDB Entry
- https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2596766Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.