VulnerabilityDeferred

CVE-2024-47582

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack.

MEDIUM 5.3EPSS 0.42%

Does this matter?

Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.

Description

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.42% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-611
Source: cna@sap.com

References

https://me.sap.com/notes/3351041
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.