9.8Kritisch
KEV
CVE-2016-2386SAP NetWeaver SQL Injection Vulnerability
Bekannt ausgenutzt — SAP NetWeaver SQL Injection Vulnerability
CISA hat am 09.06.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 30.06.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-2386
Beschreibung
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Schwachstellentyp (CWE):
CWE-89
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| sap | netweaver application server java | 7.40 |
Referenzen und Patches
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ Broken LinkThird Party Advisory
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html ExploitThird Party AdvisoryVDB Entry
- 39840 exploitExploitThird Party AdvisoryVDB Entry
- https://github.com/vah13/SAP_exploit ExploitThird Party Advisory
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ Broken LinkThird Party Advisory
- 43495 exploitExploitThird Party AdvisoryVDB Entry
- 20160523 [ERPSCAN-16-011] SAP NetWeaver AS JAVA - SQL injection vulnerability mailing-listExploitMailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*