Read the docs
TI-2019-00281 Aliases CVE-2019-0340GHSA-w375-34xx-jhpq

XML external entity injection in SAP Enable Now

Priority LOW 26CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.

Why it matters now

EPSS 0.00689 52nd percentileScored 2026-11-07
Fix Fixed SAP Enable Now (SAP SE): 1902

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Enable Nowbefore 19021902Patch availableCNA
  • SAP Enable Now VendorSAP Affected before 1902 Fixed in 1902 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:enable_now:*:*:*:*:*:*:*:*before 1902VulnerableSAP
  • cpe:2.3:a:sap:enable_now:*:*:*:*:*:*:*:* Versions before 1902 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Enable Now (SAP SE) Fixed in 1902

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0340
  2. 2026-10-03 Alias added: GHSA-w375-34xx-jhpq

References

Advisory 2

  • TI-2019-00327 CSV injection in SAP Enable Now CVSS 3.1CRITICAL 9.8
  • TI-2019-00282 Incorrect permission assignment in SAP Enable Now CVSS 3.0HIGH 8.8
  • TI-2019-00329 Information disclosure in SAP Enable Now CVSS 3.1HIGH 7.5
  • TI-2019-00328 Information disclosure through error messages in SAP Enable Now CVSS 3.1HIGH 7.5
  • TI-2023-18703 Information Disclosure in SAP Enable Now CVSS 3.1MEDIUM 5.3
  • TI-2019-00315 Cross-site scripting in SAP Enable Now CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences