title: External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
description: The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.
problem types: CWE-611: Improper Restriction of XML External Entity Reference
affected:
{
defaultStatus: unaffected
product: SAP S/4HANA (Create Single Payment application)
vendor: SAP_SE
versions:
status: affected, version: 100
status: affected, version: 101
status: affected, version: 102
status: affected, version: 103
status: affected, version: 104
status: affected, version: 105
status: affected, version: 106
status: affected, version: 107
status: affected, version: 108
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL