PT-2019-1731 · Sap · Sap Hana Extended Application Services

Published 2019-03-12 · Updated 2019-03-13 · CVE-2019-0277

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:N/AC:L/Au:M/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP HANA Extended Application Services version 1, advanced

Description The issue is related to errors in processing XML documents. It may allow a remote attacker to access protected information or cause a denial of service using a specially crafted XML file. The problem is due to insufficient validation of an XML document accepted from an authenticated developer with privileges to the SAP space, which is related to an XML External Entity vulnerability.

Recommendations For SAP HANA Extended Application Services version 1, advanced, consider restricting access to the XML processing functionality until a proper fix is applied, and ensure that all XML documents are thoroughly validated before processing to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2019-01365

CVE-2019-0277

Affected Products

Sap Hana Extended Application Services

References · 6

• https://osv.dev/vulnerability/CVE-2019-0277 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0277 · Security Note
• https://bdu.fstec.ru/vul/2019-01365 · Security Note
• https://launchpad.support.sap.com/#/notes/2764283 · Vendor Advisory
• http://securityfocus.com/bid/107356 · Note