CVE-2017-11457: SAP NetWeaver Application Server Java

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249.

Affected products

• SAP NetWeaver Application Server Java: version 7.50 only

Published 2017-07-25. Last modified 2026-06-17.