PT-2016-1706 · Sap · Sap Netweaver As Java

Vahagn Vardanyan · Publicado 2016-04-14 · Atualizado 2018-12-10 · CVE-2016-4014

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver JAVA AS 7.4

Description The issue is related to an XML external entity (XXE) vulnerability in the UDDI component, which is caused by incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to cause a denial of service (system hang) by sending a crafted XML request. The API endpoint /uddi/api/replication is specifically vulnerable to this type of attack.

Recommendations For SAP NetWeaver JAVA AS 7.4, consider disabling the UDDI component until a patch is available to prevent exploitation of the XXE vulnerability. Restrict access to the /uddi/api/replication API endpoint to minimize the risk of a denial of service attack.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2016-01032

CVE-2016-4014

Produtos afetados

Sap Netweaver As Java

Referências · 10

• 🔥 https://github.com/murataydemir/CVE-2016-4014 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Jul/45 · Exploit
• 🔥 http://packetstormsecurity.com/files/137919/SAP-NetWeaver-AS-JAVA-7.4-XXE-Injection.html · Exploit
• https://erpscan.io/advisories/erpscan-16-020-sap-netweaver-java-uddi-component-xxe-vulnerability · Nota
• https://bdu.fstec.ru/vul/2016-01032 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-4014 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4014 · Nota de Segurança
• https://erpscan.io/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016 · Nota
• https://erpscan.com/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016 · Nota
• https://erpscan.com/advisories/erpscan-16-020-sap-netweaver-java-uddi-component-xxe-vulnerability · Nota