CVE-2024-42374

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.

• CWE-91

• https://me.sap.com/notes/3485284Permissions Required
• https://url.sap/sapsecuritypatchdayVendor Advisory

Published

Aug 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42369matrix-js-sdk is a Matrix messaging protocol Client-Server S…5.3
• CVE-2024-4237A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-42370Litestar is an Asynchronous Server Gateway Interface (ASGI) …8.3
• CVE-2024-42371The RFC enabled function module allows a low privileged user…5.4
• CVE-2024-42372Due to missing authorization check in SAP NetWeaver AS Java …6.5
• CVE-2024-42373SAP Student Life Cycle Management (SLcM) fails to conduct pr…5.4
• CVE-2024-42375SAP BusinessObjects Business Intelligence Platform allows …4.3
• CVE-2024-42376SAP Shared Service Framework does not perform necessary auth…6.5
• CVE-2024-42377SAP shared service framework allows an authenticated non-adm…4.3
• CVE-2024-42378Due to weak encoding of user-controlled inputs, eProcurement…6.1
• CVE-2024-42379Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-4238A vulnerability has been found in Tenda AX1806 1.0.0.1 and c…8.8