Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-42374 Details

Description

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://me.sap.com/notes/3485284 [email protected]Permissions Required
https://url.sap/sapsecuritypatchday [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-91XML Injection (aka Blind XPath Injection)[email protected]

Affected Products

ProductVersions
sap bex web java runtime export web service
bi-base-b_7.5
bi-base-e_7.5
bi-base-s_7.5
bi-ibc_7.5
biwebapp_7.5

CPE

  • cpe:2.3:a:sap:bex_web_java_runtime_export_web_service:bi-base-b_7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:bex_web_java_runtime_export_web_service:bi-base-e_7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:bex_web_java_runtime_export_web_service:bi-base-s_7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:bex_web_java_runtime_export_web_service:bi-ibc_7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:bex_web_java_runtime_export_web_service:biwebapp_7.5:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-42374
NVD Published Date:
Aug 13, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-42374 Details - Not Deferred