SAP NetWeaver Process Integration XML external entity Vulnerability

Release date:
Updated on: 2012-11-01

Affected Systems:
SAP NetWeaver Process Integration 7.x
Description:
--------------------------------------------------------------------------------
SAP NetWeaver Process Integration (sap pi) is an enterprise-level application Integration software for internal and external information interaction.

When SAP NetWeaver Process Integration verifies an XML request, an error occurs in the pi sdk xml parser, which may expose sensitive information.

<* Source: Alexander Polyakov

Link: http://secunia.com/advisories/51152/
Http://erpscan.com/advisories/dsecrg-12-038-sap-netweaver-pi-sdk-xxe-and-xxe-tunneling/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

SAP
---
Apply SAP Security Note 1723641:

Https://service.sap.com/sap/support/notes/1723641