CVE-2019-0265 XML external entity in ABAP Platform (KERNEL)

Medium 4.9 Published 15 Feb 2019 Updated 4 Aug 2024

An attacker can cause a denial of service in SAP ABAP Platform via SLD Registration, preventing legitimate users from accessing the service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-0265?

CVE-2019-0265 is a medium-severity vulnerability in SAP SE ABAP Platform (KERNEL), published on 15 Feb 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.

Weakness: CWE-611

Which versions are affected by CVE-2019-0265?

It affects 5 products.

Products include Sap Advanced Business Application Programming Platform Kernel, Sap Advanced Business Application Programming Platform Krnl32nuc, Sap Advanced Business Application Programming Platform Krnl32uc, Sap Advanced Business Application Programming Platform Krnl64nuc, Sap Advanced Business Application Programming Platform Krnl64uc.

How do I fix CVE-2019-0265?

No fix has been published for CVE-2019-0265 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-0265 being exploited?

There is no known exploitation of CVE-2019-0265 in the wild and no public exploit code.

Sources

Also known as GHSA-5g9g-w9x5-3rfc.