Test ID:	1.3.6.1.4.1.25623.1.0.106083
Category:	Web Servers
Title:	SAP NetWeaver AS Java Multiple Vulnerabilities (2101079, 2191290, 2256846)
Summary:	SAP NetWeaver Application Server (AS) Java is prone to multiple; vulnerabilities.
Description:	Summary: SAP NetWeaver Application Server (AS) Java is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - CVE-2016-1910: The User Management Engine (UME) allows attackers to decrypt unspecified data via unknown vectors. - CVE-2016-2386: SQL injection vulnerability in the UDDI server. - CVE-2016-2388: The Universal Worklist Configuration allows remote attackers to obtain sensitive user information via a crafted HTTP request. Vulnerability Impact: A remote attacker may execute arbitrary SQL commands or obtain sensitive user information via a crafted HTTP request. Affected Software/OS: SAP NetWeaver AS Java version 7.10 (7.1) through 7.50 (7.5). Solution: See the referenced vendor advisories for a solution. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-1910 BugTraq ID: 80920 http://www.securityfocus.com/bid/80920 https://www.exploit-db.com/exploits/43495/ http://seclists.org/fulldisclosure/2016/Apr/60 https://erpscan.io/advisories/erpscan-16-003-sap-netweaver-7-4-cryptographic-issues/ https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/ Common Vulnerability Exposure (CVE) ID: CVE-2016-2386 https://www.exploit-db.com/exploits/39840/ http://seclists.org/fulldisclosure/2016/May/56 http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ https://github.com/vah13/SAP_exploit Common Vulnerability Exposure (CVE) ID: CVE-2016-2388 https://www.exploit-db.com/exploits/39841/ http://seclists.org/fulldisclosure/2016/May/55 http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.