CVE-2018-2401

SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.

Score

CVSS 3.0 8.8 High

Status

Modified - cna@sap.com

Published

2018-03-14

Last modified

2024-08-05

Weaknesses

CWE-611

Affected products

• Sap Business Process Automation (Redwood)
• Sap Business Process Automation Bpa By Redwood (Sap Se)

References

• http://www.securityfocus.com/bid/103374
• https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/
• https://launchpad.support.sap.com/#/notes/2596766