What is CVE-2019-0277?

CVE-2019-0277 is a medium-severity vulnerability in Sap Hana_extended_application_services, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2019-03-12.

How severe is CVE-2019-0277?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2019-0277 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XXE in Sap Hana_extended_application_services

CVE-2019-0277

SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).

Vulnerability class: XXE (XML External Entity)

EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H.

Affected products

Sap Hana_extended_application_services — versions 1.0
Sap Se Hana Extended Application Services — versions < 1

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

Public proof-of-concept exploits

lmkalg/my_

References

cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2019-0277?: CVE-2019-0277 is a medium-severity vulnerability in Sap Hana_extended_application_services, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2019-03-12.
How severe is CVE-2019-0277?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2019-0277 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.