CVE-2019-0271
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability.
Does this matter?
Lower severity and a low EPSS score (1.44%). Track it; it rarely justifies an emergency change on its own.
Description
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform. For more recent updates please refer to Security Note 2870067 (which supersedes the solution of Security Note 2736825) in the reference section below.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.44% probability · 73th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- sap/advanced business application programming platform · sap/advanced business application programming server · sap/sap kernel
- Source
- cna@sap.com
EPSS 1.4% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/107355Broken Link
- https://launchpad.support.sap.com/#/notes/2736825Permissions Required, Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2870067Permissions Required, Vendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080Vendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812Vendor Advisory
- http://www.securityfocus.com/bid/107355Broken Link
- https://launchpad.support.sap.com/#/notes/2736825Permissions Required, Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2870067Permissions Required, Vendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080Vendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.