CVE-2019-0396

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-13 · updated 2026-06-17
Weakness: CWE-20

Description

SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can craft a message that contains malicious elements that will not be correctly filtered by Web Intelligence HTML interface in some specific workflows.

Affected products

SAP_SE SAP BusinessObjects Business Intelligence Platform: 4.0, 4.1-sp10, 4.1-sp11, 4.1-sp12

References

https://launchpad.support.sap.com/#/notes/2814007
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390
https://launchpad.support.sap.com/#/notes/2814007
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390

Get alerted when CVE-2019-0396 or the next vulnerability affects your stack