CVE-2024-47582: XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA

Deferred

Published 10-12-2024Last modified 10-12-2024

Vulnerability summary

CVE-2024-47582 is a medium (CVSS 5.3) vulnerability in sap_se sap netweaver as java. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.3% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

10-12-2024
PublishedVulnerability first disclosed.
10-12-2024
Last modifiedVulnerability information updated.

Description

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.

CVSS metrics

2 scores · 2 sources · 1 version

v3.15.3

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.44% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected systems

Sap_se1 product

sap netweaver as javaLM-CORE 7.50

1 vendor · 1 product

References

2 links