Code Injection via XSL Transformation in SAP Manufacturing Integration and Intelligence
SAP Manufacturing Integration and Intelligence (MII)
CVSS 9.9. MII bridges shop-floor equipment with SAP ERP and S/4HANA — a compromised MII server can disrupt production data flows, plant integrations, and the business processes that depend on them. If your plant runs MII 15.4 or 15.5, this is an immediate call. August is a historically quiet month for manufacturing plants; use that window.
Vulnerability Detail
A code injection vulnerability in the XSL transformation servlet of SAP Manufacturing Integration and Intelligence (MII) allows a low-privileged attacker to submit malicious input that triggers server-side request forgery (SSRF), enabling the server to fetch attacker-controlled external content and execute arbitrary operating system commands. The attack requires only low privileges on the MII system.
Workaround
Restrict access to the vulnerable XSL transformation servlet using network controls or WAF rules. Block outbound HTTP from the MII server to untrusted external destinations as a temporary SSRF mitigation.
Patch Action
Apply SAP Note 3765948. SAP introduced Secure Transformer and Allowed Hosts controls as part of the remediation — verify these are correctly configured post-patch.
Affected Versions
Patch Info