CVE-2024-42374: SAP Bex Web Java Runtime Export Web Service

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

Affected products

• SAP Bex Web Java Runtime Export Web Service: version bi-base-b_7.5 only; version bi-base-e_7.5 only; version bi-base-s_7.5 only; version bi-ibc_7.5 only; version biwebapp_7.5 only

Published 2024-08-13. Last modified 2026-06-17.