CVE-2018-2462: Input Validation
Published Sep 11, 2018
·Updated
In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source.
Affected Software
5 affected components
SAP NetWeaver=7.30
SAP NetWeaver=7.31
SAP NetWeaver=7.40
SAP NetWeaver=7.41
SAP NetWeaver=7.50
Event History
Sep 11, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2018-2462?
CVE-2018-2462 is a vulnerability in the BEx Web Java Runtime Export Web Service in SAP NetWeaver BI.
2
What is the severity of CVE-2018-2462?
The severity of CVE-2018-2462 is high with a CVSS score of 8.8.
3
Which versions of SAP NetWeaver BI are affected by CVE-2018-2462?
SAP NetWeaver BI 7.30, 7.31, 7.40, 7.41, and 7.50 are affected by CVE-2018-2462.
4
How does CVE-2018-2462 impact SAP NetWeaver BI?
CVE-2018-2462 allows an attacker to execute arbitrary code on the affected system if a malicious XML document is accepted from an untrusted source.
5
How can I fix CVE-2018-2462?
To fix CVE-2018-2462, apply the necessary security patches provided by SAP and ensure that XML documents are only accepted from trusted sources.