NVD

Id
19705  
Name
CVE-2016-3974  
Description
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-04-07  
Modified Date
2016-11-29  
Seq
2016-3974  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
107966 19705 CVE-2016-3974 http://packetstormsecurity.com/files/137527/SAP-NetWeaver-AS-JAVA-7.5-XXE-Injection.html  View
107967 19705 CVE-2016-3974 20160618 [ERPSCAN-16-013] SAP NetWeaver AS Java ctcprotocol servlet - XXE vulnerability  View
107968 19705 CVE-2016-3974 https://erpscan.com/advisories/erpscan-16-013-sap-netweaver-7-4-ctcprotocol-servlet-xxe/  View
107969 19705 CVE-2016-3974 https://erpscan.com/press-center/blog/sap-security-notes-march-2016-review/  View
107970 19705 CVE-2016-3974 39995  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1228 JVNDB-2016-002001 SAP NetWeaver Java AS の Configuration Wizard における XML 外部エンティティの脆弱性 SAP NetWeaver Java AS の Configuration Wizard には、ctcprotocol サーブレットに関する処理に不備があるため、XML 外部エンティティ (XXE) の脆弱性が存在します。 CVE-2016-3974 90480 CVE-2016-3974 19705 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002001.html 2016-03-08 2016-04-13 View