CVE-2019-0284

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source

published April 10, 2019

CVSS
—
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Published
2019-04-10T20:25Z
EPSS history
Timeline
  • 10 APR 20:25Z
    SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source
    cvelistv5