CVE-2019-0284

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.

Metrics

CVSS 3.0 6.0/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
SAP SE	SAP HANA	< 1.0; < 2.0

References

https://launchpad.support.sap.com/#/notes/2772376Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory
https://launchpad.support.sap.com/#/notes/2772376Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory

Timeline

Published: Apr 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-02859.8The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information includ CVE-2019-02877.6Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an att CVE-2019-02897.1Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to CVE-2019-02915.5Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.CVE-2019-02936.5Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information CVE-2019-02986.1SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XS CVE-2019-03018.8Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST I CVE-2019-03036.1SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting CVE-2019-03049.8FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRN CVE-2019-03054.3Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, CVE-2019-03064.3SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as S CVE-2019-03072.4Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communicat