CVE-2023-26461 XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)

Medium 6.8 Published 14 Mar 2023 Updated 27 Feb 2025

An authenticated attacker with sufficient privileges can exploit an XML External Entity vulnerability to read sensitive files and data.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-26461?

CVE-2023-26461 is a medium-severity vulnerability in NetWeaver (SAP Enterprise Portal), published on 14 Mar 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view sensitive data which is owned by certain privileges.

Weakness: CWE-611

Which versions are affected by CVE-2023-26461?

It affects 1 product.

Products include Sap Netweaver Enterprise Portal.

How do I fix CVE-2023-26461?

No fix has been published for CVE-2023-26461 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-26461 being exploited?

There is no known exploitation of CVE-2023-26461 in the wild and no public exploit code.

Sources

Also known as GHSA-6cmx-5pqj-8h85.