PT-2016-3362 · Sap · Sap Netweaver As Java

Published 2016-03-09 · Updated 2025-04-03 · CVE-2016-9563

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.5

Description The issue is related to an XML External Entity (XXE) vulnerability in the BC-BMT-BPM-DSK component of SAP NetWeaver AS JAVA. This vulnerability allows remote authenticated users to conduct XXE attacks via the "sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn" URI. The vulnerability is associated with insufficient restrictions on XML external entities, which can be exploited by a remote attacker to conduct XXE attacks.

Recommendations For SAP NetWeaver AS JAVA version 7.5, apply the fix provided in SAP Security Note 2296909 to resolve the issue. As a temporary workaround, consider restricting access to the BC-BMT-BPM-DSK component to minimize the risk of exploitation. Avoid using the vulnerable URI "sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn" until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-05600

CVE-2016-9563

Affected Products

Sap Netweaver As Java

References · 10

• https://bdu.fstec.ru/vul/2021-05600 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-9563 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9563 · Vendor Advisory
• https://t.me/cvenotify/117666 · Telegram Post
• https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component · Note
• https://t.me/cvenotify/110399 · Telegram Post
• https://t.me/cvenotify/108276 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9563 · Note
• http://securityfocus.com/bid/92419 · Note
• https://launchpad.support.sap.com/#/notes/2296909 · Note