Login Request a demo
Medium severity · published Aug 14, 2019
CVE-2019-0340
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Enable Now · Sap
before 1902 · source: NVD
Affected product
EN
Enable Now
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0340
Permissions Required
https://launchpad.support.sap.com/#/notes/2794742
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
More from Enable Now
9.8
CVE-2019-0403
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection
8.8
CVE-2019-0341
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set
7.5
CVE-2019-0405
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration…
7.5
CVE-2019-0404
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure
6.5
CVE-2019-0385
SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability