Lucene search

SapCVE-2019-0340

HistoryAug 14, 2019 - 2:15 p.m.

CVE-2019-0340

2019-08-1414:15:16

CWE-611

sap

web.nvd.nist.gov

sap enable now

xml parser

vulnerability

missing xml validation

xxe

file upload

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.

Affected configurations

Nvd

Node

sapenable_nowRange<1902

VendorProductVersionCPE
sapenable_now*cpe:2.3:a:sap:enable_now:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	enable_now	*	cpe:2.3:a:sap:enable_now::::::::

CNA Affected

[
  {
    "product": "SAP Enable Now",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1902"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2794742

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017

Social References

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2019-0340