CVE-2019-0284: sap se sap hana

Vulnerability summary

CVE-2019-0284 is a medium (CVSS 6.0) vulnerability in sap se sap hana. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.5% of scored vulnerabilities.

Timeline

1. 10-04-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.