Test ID:	1.3.6.1.4.1.25623.1.0.106104
Category:	Web Servers
Title:	SAP NetWeaver AS Java Multiple Vulnerabilities (2235994, 2234971, 2238375)
Summary:	SAP NetWeaver Application Server (AS) Java is prone to multiple; vulnerabilities.
Description:	Summary: SAP NetWeaver Application Server (AS) Java is prone to multiple vulnerabilities. Vulnerability Insight: SAP NetWeaver AS Java contains multiple vulnerabilities: - CVE-2016-3974: An XML external entity (XXE) vulnerability in the Configuration Wizard allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request related to the ctcprotocol servlet. - CVE-2016-3975: Anonymous attacker can use an XSS vulnerability to hijack session data of administrators or users of a web resource. - CVE-2016-3976: An authorized attacker can use a directory traversal attack to read files from the server and then escalate his or her privileges. On April 6 2021, Onapsis and SAP released a new threat intelligence report to help SAP customers protect from active cyber threats seeking to specifically target, identify and compromise organizations running unprotected SAP applications, through a variety of cyberattack vectors. This VT is covering one or more vulnerabilities mentioned in that report. Vulnerability Impact: A remote attacker may cause a denial of service, access arbitrary files or hijack user sessions. An authenticated remote attacker may read arbitrary files leading to privilege escalation. Affected Software/OS: SAP NetWeaver AS Java version 7.10 (7.1) through 7.50 (7.5). Solution: See the referenced vendor advisories for a solution. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-3974 https://www.exploit-db.com/exploits/39995/ http://seclists.org/fulldisclosure/2016/Jun/41 http://packetstormsecurity.com/files/137527/SAP-NetWeaver-AS-JAVA-7.5-XXE-Injection.html https://erpscan.io/advisories/erpscan-16-013-sap-netweaver-7-4-ctcprotocol-servlet-xxe/ https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/ Common Vulnerability Exposure (CVE) ID: CVE-2016-3975 http://seclists.org/fulldisclosure/2016/Jun/42 http://packetstormsecurity.com/files/137529/SAP-NetWeaver-AS-JAVA-7.5-Cross-Site-Scripting.html https://erpscan.io/advisories/erpscan-16-014-sap-netweaver-7-4-navigationurltester/ Common Vulnerability Exposure (CVE) ID: CVE-2016-3976 https://www.exploit-db.com/exploits/39996/ http://seclists.org/fulldisclosure/2016/Jun/40 http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html https://erpscan.io/advisories/erpscan-16-012/ https://launchpad.support.sap.com/#/notes/2234971
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.