VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 12, 2019· Updated Jun 17, 2026

CVE-2019-0271

CVE-2019-0271

Description

ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform. For more recent updates please refer to Security Note 2870067 (which supersedes the solution of Security Note 2736825) in the reference section below.

Affected products

11
  • SAP SE/ABAP Serverv5
    Range: < from 7.00 to 7.31
  • SAP SE/ABAP Server & Platformv5
    Range: < from 7.40 to 7.52
  • SAP/ABAP Serverllm-fuzzy
  • SAP/Abap Platformllm-fuzzy
  • SAP/Advanced Business Application Programming Platform
    cpe:2.3:a:sap:advanced_business_application_programming_platform:-:*:*:*:*:*:*:*
  • SAP/Advanced Business Application Programming Server
    cpe:2.3:a:sap:advanced_business_application_programming_server:*:*:*:*:*:*:*:*
    Range: >=7.00,<=7.31
  • SAP/Kernel5 versions
    cpe:2.3:a:sap:sap_kernel:7.21:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:sap:sap_kernel:7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:sap_kernel:7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:sap_kernel:7.45:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:sap_kernel:7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:sap_kernel:7.53:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.