How severe is CVE-2022-28213?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2022-28213 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in SAP Businessobjects Business Intelligence Platform

CVE-2022-28213

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.

EPSS: 0.125 (95.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.

Affected products

Sap Businessobjects_business_intelligence_platform — versions 420, 430
Sap Se Businessobjects Business Intelligence Platform — versions 420, 430

Weakness classification (CWE)

CWE-112

Public proof-of-concept exploits

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
cna@sap.com (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-28213?: CVE-2022-28213 is a high-severity vulnerability in SAP Businessobjects Business Intelligence Platform, classified under CWE-112. CVSS score: 8.1/10. Published 2022-04-12.
How severe is CVE-2022-28213?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2022-28213 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.