Test Kennung:	1.3.6.1.4.1.25623.1.0.106083
Kategorie:	Web Servers
Titel:	SAP NetWeaver AS Java Multiple Vulnerabilities (2101079, 2191290, 2256846)
Zusammenfassung:	SAP NetWeaver Application Server (AS) Java is prone to multiple; vulnerabilities.
Beschreibung:	Summary: SAP NetWeaver Application Server (AS) Java is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - CVE-2016-1910: The User Management Engine (UME) allows attackers to decrypt unspecified data via unknown vectors. - CVE-2016-2386: SQL injection vulnerability in the UDDI server. - CVE-2016-2388: The Universal Worklist Configuration allows remote attackers to obtain sensitive user information via a crafted HTTP request. Vulnerability Impact: A remote attacker may execute arbitrary SQL commands or obtain sensitive user information via a crafted HTTP request. Affected Software/OS: SAP NetWeaver AS Java version 7.10 (7.1) through 7.50 (7.5). Solution: See the referenced vendor advisories for a solution. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-1910 BugTraq ID: 80920 http://www.securityfocus.com/bid/80920 https://www.exploit-db.com/exploits/43495/ http://seclists.org/fulldisclosure/2016/Apr/60 https://erpscan.io/advisories/erpscan-16-003-sap-netweaver-7-4-cryptographic-issues/ https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/ Common Vulnerability Exposure (CVE) ID: CVE-2016-2386 https://www.exploit-db.com/exploits/39840/ http://seclists.org/fulldisclosure/2016/May/56 http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ https://github.com/vah13/SAP_exploit Common Vulnerability Exposure (CVE) ID: CVE-2016-2388 https://www.exploit-db.com/exploits/39841/ http://seclists.org/fulldisclosure/2016/May/55 http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/
Copyright	Copyright (C) 2016 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.