PT-2019-1731 · Sap · Sap Hana Extended Application Services

Publicado 2019-03-12 · Atualizado 2019-03-13 · CVE-2019-0277

Positive Technologies (AI Summary)

CVSS v2.0

7.7

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services version 1, advanced

Description The issue is related to errors in processing XML documents. It may allow a remote attacker to access protected information or cause a denial of service using a specially crafted XML file. The problem is due to insufficient validation of an XML document accepted from an authenticated developer with privileges to the SAP space, which is related to an XML External Entity vulnerability.

Recommendations For SAP HANA Extended Application Services version 1, advanced, consider restricting access to the XML processing functionality until a proper fix is applied, and ensure that all XML documents are thoroughly validated before processing to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2019-01365

CVE-2019-0277

Produtos afetados

Sap Hana Extended Application Services

Referências · 6

• https://osv.dev/vulnerability/CVE-2019-0277 · Aviso do Fabricante
• http://securityfocus.com/bid/107356 · Nota
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0277 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01365 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2764283 · Aviso do Fabricante