PT-2019-2031 · Sap · Sap Netweaver Abap Server

Published 2019-02-12 · Updated 2022-04-18 · CVE-2019-0271

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver ABAP Server versions 7.00 through 7.31 SAP NetWeaver ABAP Server versions 7.40 through 7.52

Description The issue is related to errors in processing external XML objects when analyzing an XML file, specifically an XML External Entity (XXE) vulnerability. This could allow a remote attacker to cause a denial of service using a specially crafted file. The vulnerability is due to insufficient validation of an XML document accepted from an untrusted source.

Recommendations For SAP NetWeaver ABAP Server versions 7.00 through 7.31, update to Kernel 7.21 or 7.22. For SAP NetWeaver ABAP Server versions 7.40 through 7.52, update to Kernel 7.45, 7.49, or 7.53.

Fix

XXE

RCE

Weakness Enumeration

CWE-611

CWE-20

Related Identifiers

BDU:2019-01744

CVE-2019-0271

Affected Products

Sap Netweaver Abap Server

References · 8

• https://launchpad.support.sap.com/#/notes/2870067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0271 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0271 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01744 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2736825 · Vendor Advisory
• http://securityfocus.com/bid/107355 · Note