{"id":"CVE-2019-0340","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-0340","generatedAt":"2026-10-28T21:26:50.894Z","title":"The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability.","description":"The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.","published":"2019-08-14T14:15:16.000Z","lastModified":"2026-06-17T02:08:12.000Z","status":"Modified","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.0","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-611"],"affected":["sap/enable now"],"epss":{"score":0.00689,"percentile":0.52544,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2794742","tags":["Permissions Required","Vendor Advisory"],"source":"cna@sap.com"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017","tags":["Vendor Advisory"],"source":"cna@sap.com"},{"url":"https://launchpad.support.sap.com/#/notes/2794742","tags":["Permissions Required","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0340","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}