Description
UPDATE 9th April 2019: This note has been re-released with updated ‘Symptom’ and ‘Solution’ information to include Java Server.
UPDATE 12th March 2019: This note has been re-released with updated “CVSS information”.There is no action required from customer side if the note is already implemented.
SLD Registration of SAP NetWeaver (that is application server ABAP and application server Java) and ABAP Platform do not sufficiently validate an XML document accepted from an untrusted source.
Some well-known impacts of Missing XML Validation vulnerability are –
- arbitrary files retrieval from the server
- denial-of-service conditions in successful exploits
Available fix and Supported packages
- KRNL32NUC | 7.21 | 7.21
- KRNL32NUC | 7.21EXT | 7.21EXT
- KRNL32UC | 7.21 | 7.21
- KRNL32UC | 7.21EXT | 7.21EXT
- KRNL64NUC | 7.21 | 7.21
- KRNL64NUC | 7.21EXT | 7.21EXT
- KRNL64NUC | 7.22 | 7.22
- KRNL64NUC | 7.22EXT | 7.22EXT
- KRNL64NUC | 7.49 | 7.49
- KRNL64UC | 7.21 | 7.21
- KRNL64UC | 7.21EXT | 7.21EXT
- KRNL64UC | 7.22 | 7.22
- KRNL64UC | 7.22EXT | 7.22EXT
- KRNL64UC | 7.49 | 7.49
- KRNL64UC | 7.53 | 7.53
- KRNL64UC | 7.73 | 7.73
- KERNEL | 7.21 | 7.22
- KERNEL | 7.45 | 7.45
- KERNEL | 7.49 | 7.49
- KERNEL | 7.53 | 7.53
- SAP KERNEL 7.21 32-BIT | SP1210 | 001210
- SAP KERNEL 7.21 32-BIT UNICODE | SP1210 | 001210
- SAP KERNEL 7.21 64-BIT | SP1210 | 001210
- SAP KERNEL 7.21 64-BIT UNICODE | SP1210 | 001210
- SAP KERNEL 7.21 EXT 64-BIT | SP1210 | 001210
- SAP KERNEL 7.21 EXT 64-BIT UC | SP1210 | 001210
- SAP KERNEL 7.22 64-BIT | SP719 | 000719
- SAP KERNEL 7.22 64-BIT UNICODE | SP719 | 000719
- SAP KERNEL 7.22 EXT 64-BIT | SP719 | 000719
- SAP KERNEL 7.22 EXT 64-BIT UC | SP719 | 000719
- SAP KERNEL 7.45 64-BIT | SP832 | 000832
- SAP KERNEL 7.45 64-BIT UNICODE | SP832 | 000832
- SAP KERNEL 7.49 64-BIT | SP619 | 000619
- SAP KERNEL 7.49 64-BIT UNICODE | SP619 | 000619
- SAP KERNEL 7.53 64-BIT | SP318 | 000318
- SAP KERNEL 7.53 64-BIT UNICODE | SP318 | 000318
- SAP KERNEL 7.73 64-BIT UNICODE | SP031 | 000031
- SAP KERNEL 7.75 64-BIT UNICODE | SP007 | 000007
Affected component
- BC-CCM-SLD-REG
SLD registration utility sldreg[.exe]
CVSS
Score: 6.0
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2729710
