CVE-2022-28213

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.

• CWE-112

• http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://launchpad.support.sap.com/#/notes/3055044Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• http://packetstormsecurity.com/files/167046/SAP-BusinessObjects-Intelligence-4.3-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://launchpad.support.sap.com/#/notes/3055044Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Apr 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28203A denial-of-service issue was discovered in MediaWiki before…7.5
• CVE-2022-28204A denial-of-service issue was discovered in MediaWiki 1.37.x…7.5
• CVE-2022-28205An issue was discovered in MediaWiki through 1.37.1. The Cen…9.8
• CVE-2022-28206An issue was discovered in MediaWiki through 1.37.1. ImportP…9.8
• CVE-2022-28209An issue was discovered in Mediawiki through 1.37.1. The che…9.8
• CVE-2022-2821Missing Critical Step in Authentication in GitHub repository…7.5
• CVE-2022-28214During an update of SAP BusinessObjects Enterprise, Central …7.8
• CVE-2022-28215SAP NetWeaver ABAP Server and ABAP Platform - versions 740, …4.7
• CVE-2022-28216SAP BusinessObjects Business Intelligence Platform (BI Works…6.1
• CVE-2022-28217Some part of SAP NetWeaver (EP Web Page Composer) does not s…6.5
• CVE-2022-28218An issue was discovered in CipherMail Webmail Messenger 1.1.…5.5
• CVE-2022-28219Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vuln…9.8