PT-2019-11218 · Sap · Sap Hana

Publicado 2019-04-10 · Atualizado 2019-04-11 · CVE-2019-0284

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: SAP HANA versions prior to 1.0 SAP HANA versions prior to 2.0

Description: The issue concerns insufficient validation of an XML document accepted from an untrusted source in SLD Registration. An attacker can exploit this by calling SLDREG with a malicious XML file containing a reference to an XML External Entity (XXE). This can lead to SLDREG continuously looping, reading arbitrary files, or even sending local files.

Recommendations: For versions prior to 1.0, update to version 1.0 to resolve the issue. For versions prior to 2.0, update to version 2.0 to resolve the issue.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-0284

Produtos afetados

Sap Hana

Referências · 4

• https://launchpad.support.sap.com/#/notes/2772376 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-0284 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0284 · Nota de Segurança