CVE-2022-28213: When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML…

PriorityP264high8.1CVSS 3.1

AVNACLPRLUINSUCHINAH

EXPLOIT

EPSS

12.48%

95.8th percentile

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sap	businessobjects_business_intelligence_platform	—	—
sap	businessobjects_business_intelligence_platform	—	—
sap_se	sap_businessobjects_business_intelligence_platform	—	—
sap_se	sap_businessobjects_business_intelligence_platform	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://example.com/biprws/logon/long↗

path/biprws/logon/long↗

commandcurl -sk -X POST -H 'Content-Type: application/xml;charset=UTF-8' --data '%remote;%int;%trick;]>' https://example.com/biprws/logon/long↗

→Monitor for HTTP POST requests to the SAP BusinessObjects SOAP endpoint /biprws/logon/long with a Content-Type of 'application/xml' — this is the targeted attack path for XXE exploitation. ↗
→Detect XML payloads containing external entity references (e.g., parameter entity patterns like '%remote;%int;%trick;') in POST bodies to SAP BusinessObjects SOAP web service endpoints. ↗
→Alert on XML documents submitted to SAP BusinessObjects BI Platform SOAP services that include DOCTYPE declarations or external entity definitions, indicative of XXE attempts targeting arbitrary file retrieval or DoS. ↗

·The exploit was tested specifically on Windows Server 2019 x64; behavior or file retrieval paths may differ on other OS platforms hosting SAP BusinessObjects. ↗
·Affected versions are SAP BusinessObjects Business Intelligence Platform versions 420 and 430; detections should be scoped to these versions. ↗

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.