CVE-2019-0271: sap se abap server Improper Input Validation
Vulnerability summary
CVE-2019-0271 is a medium (CVSS 6.5) Improper Input Validation vulnerability in sap se abap server. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.
Timeline
- 12-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform. For more recent updates please refer to Security Note 2870067 (which supersedes the solution of Security Note 2736825) in the reference section below.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.44%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.44% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap3 products
- advanced_business_application_programming_platformna
- advanced_business_application_programming_server≥ 7.00, ≤ 7.31 | ≥ 7.40, ≤ 7.52
- sap_kernel7.21 | 7.22 | 7.45 | 7.49 | 7.53
Sap se2 products
- abap server< from 7.00 to 7.31
- abap server & platform< from 7.40 to 7.52
2 vendors · 5 products