Description
The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.
References
- sap-crm-xml-info-disc(89703) vdb-entry
- 1029488 vdb-entry
- http://scn.sap.com/docs/DOC-8218
- 56064 third-party-advisory
- 64265 vdb-entry
- https://service.sap.com/sap/support/notes/1909665
- https://erpscan.io/advisories/erpscan-13-025-sap-crm-crm_flex_data-xxe/