PT-2019-2031 · Sap · Sap Netweaver Abap Server

Publicado 2019-02-12 · Atualizado 2022-04-18 · CVE-2019-0271

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver ABAP Server versions 7.00 through 7.31 SAP NetWeaver ABAP Server versions 7.40 through 7.52

Description The issue is related to errors in processing external XML objects when analyzing an XML file, specifically an XML External Entity (XXE) vulnerability. This could allow a remote attacker to cause a denial of service using a specially crafted file. The vulnerability is due to insufficient validation of an XML document accepted from an untrusted source.

Recommendations For SAP NetWeaver ABAP Server versions 7.00 through 7.31, update to Kernel 7.21 or 7.22. For SAP NetWeaver ABAP Server versions 7.40 through 7.52, update to Kernel 7.45, 7.49, or 7.53.

Correção

XXE

RCE

Enumeração de Fraquezas

CWE-611

CWE-20

Identificadores relacionados

BDU:2019-01744

CVE-2019-0271

Produtos afetados

Sap Netweaver Abap Server

Referências · 8

• https://launchpad.support.sap.com/#/notes/2870067 · Aviso do Fabricante
• http://securityfocus.com/bid/107355 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-0271 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-0271 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01744 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2736825 · Aviso do Fabricante