Insufficient XML Document Validation in SAP Mobile Platform 3.0
CVE-2020-6177

4.3MEDIUM

Key Information:

Vendor
SAP
Status
SAP Mobile Platform
Vendor
CVE Published:
12 February 2020

Summary

SAP Mobile Platform 3.0 has a vulnerability where it fails to adequately validate XML documents from untrusted sources. This can potentially lead to a partial denial of service, affecting the overall performance and availability of the platform. While the platform does not permit External Entity resolution, preventing the leakage of server file contents, the inadequate validation poses a risk that should not be overlooked by users and administrators.

Affected Version(s)

SAP Mobile Platform = 3.0

References

https://launchpad.support.sap.com/#/notes/2880993
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.