CVE-2019-0340 XML external entity in SAP Enable Now

Medium 5.4 Published 14 Aug 2019 Updated 4 Aug 2024

An attacker can exploit an unhardened XML parser in SAP Enable Now to read local files via XML External Entity injection.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-0340?

CVE-2019-0340 is a medium-severity vulnerability in SAP Enable Now, published on 14 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.

Weakness: CWE-611

Which versions are affected by CVE-2019-0340?

It affects 1 product.

Products include Sap Enable Now.

How do I fix CVE-2019-0340?

No fix has been published for CVE-2019-0340 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-0340 being exploited?

There is no known exploitation of CVE-2019-0340 in the wild and no public exploit code.

Sources

Also known as GHSA-w375-34xx-jhpq.