CVE Vulnerabilities

CVE-2019-0265

Improper Restriction of XML External Entity Reference

Published: Feb 15, 2019 | Modified: Nov 21, 2024
CVSS 3.x
4.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.

Weakness

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected Software

Name Vendor Start Version End Version
Advanced_business_application_programming_platform_kernel Sap 7.21 (including) 7.22 (including)
Advanced_business_application_programming_platform_kernel Sap 7.45 (including) 7.45 (including)
Advanced_business_application_programming_platform_kernel Sap 7.49 (including) 7.49 (including)
Advanced_business_application_programming_platform_kernel Sap 7.53 (including) 7.53 (including)
Advanced_business_application_programming_platform_kernel Sap 7.73 (including) 7.73 (including)
Advanced_business_application_programming_platform_kernel Sap 7.75. (including) 7.75. (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.49 (including) 7.49 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.49 (including) 7.49 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.73 (including) 7.73 (including)

Potential Mitigations

References