Description
SLD Registration in SAP HANA does not sufficiently validate an XML document accepted from an untrusted source.
Some well-known impacts of Missing XML Validation vulnerability are –
- arbitrary files retrieval from the server
- denial-of-service conditions in successful exploits
Available fix and Supported packages
- HDB | 1.00 | 1.00
- HDB | 2.00 | 2.00
- SAP HANA DATABASE 1.00 | SP122 | 000024
- SAP HANA DATABASE 2.0 | SP024 | 000009
- SAP HANA DATABASE 2.0 | SP037 | 000000
Affected component
- HAN-DB
SAP HANA Database
CVSS
Score: 5.1
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2772376
