SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: sap
Published: 2019-04-10T20:25:40
Updated: 2024-08-04T17:44:16.347Z
Reserved: 2018-11-26T00:00:00
Link: CVE-2019-0284
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-04-10T21:29:01.357
Modified: 2024-11-21T04:16:38.263
Link: CVE-2019-0284
Redhat
No data.