What is CVE-2019-0284?

CVE-2019-0284 is a medium-severity vulnerability in Sap Hana, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.0/10. Published 2019-04-10.

How severe is CVE-2019-0284?

Medium severity. CVSS v3 base score is 6.0 out of 10.

XXE in Sap Hana

CVE-2019-0284

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.004 (27.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H.

Affected products

Sap Hana — versions 1.0, 2.0
Sap Se Hana — versions < 1.0, < 2.0

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cna@sap.com (x_refsource_CONFIRM, Vendor Advisory)
cna@sap.com (Vendor Advisory, Permissions Required, x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2019-0284?: CVE-2019-0284 is a medium-severity vulnerability in Sap Hana, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.0/10. Published 2019-04-10.
How severe is CVE-2019-0284?: Medium severity. CVSS v3 base score is 6.0 out of 10.