High severity · published Aug 2, 2018
CVE-2017-16349
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC
8.1
CVSS
1.2%
EPSS
No
On KEV
Description
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SAP · Insteon
SAP BPC · source: vendor
BP
Business Planning And Consolidation · Sap
All versions, or not specified · source: NVD