XXE in SAP Enable Now
CVE-2019-0340
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.007 · change: -0.003
Affected products
- SAP Enable Now
- SAP Se Enable Now — versions < 1902
Weakness classification (CWE)
References
- wiki.scn.sap.com/wiki/pages/viewpage.action (Vendor Advisory)
- launchpad.support.sap.com/ (Permissions Required, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-0340?
- CVE-2019-0340 is a medium-severity vulnerability in SAP Enable Now, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.4/10. Published 2019-08-14.
- How severe is CVE-2019-0340?
- Medium severity. CVSS v3 base score is 5.4 out of 10.