9.8Kritik
KEV
CVE-2016-2386SAP NetWeaver SQL Injection Vulnerability
Aktif olarak istismar ediliyor — SAP NetWeaver SQL Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 09.06.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 30.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-2386
Açıklama
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Zayıflık türü (CWE):
CWE-89
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| sap | netweaver application server java | 7.40 |
Kaynaklar ve yamalar
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ Broken LinkThird Party Advisory
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html ExploitThird Party AdvisoryVDB Entry
- 39840 exploitExploitThird Party AdvisoryVDB Entry
- https://github.com/vah13/SAP_exploit ExploitThird Party Advisory
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ Broken LinkThird Party Advisory
- 43495 exploitExploitThird Party AdvisoryVDB Entry
- 20160523 [ERPSCAN-16-011] SAP NetWeaver AS JAVA - SQL injection vulnerability mailing-listExploitMailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*