What is CVE-2019-0340?

CVE-2019-0340 is a medium-severity vulnerability in SAP Enable Now, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.4/10. Published 2019-08-14.

How severe is CVE-2019-0340?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XXE in SAP Enable Now

CVE-2019-0340

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.007 (50.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Sap Enable_now
Sap Se Enable Now — versions < 1902

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-0340?: CVE-2019-0340 is a medium-severity vulnerability in SAP Enable Now, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.4/10. Published 2019-08-14.
How severe is CVE-2019-0340?: Medium severity. CVSS v3 base score is 5.4 out of 10.