CVE-2016-3976

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-3976
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2016/Jun/40 Exploit Mailing List Third Party Advisory
https://erpscan.io/advisories/erpscan-16-012/ Third Party Advisory
https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/ Third Party Advisory
https://launchpad.support.sap.com/#/notes/2234971 Permissions Required
https://www.exploit-db.com/exploits/39996/ Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*
History

29 Apr 2022, 15:36

Type Values Removed Values Added
References (MISC) https://launchpad.support.sap.com/#/notes/2234971 - (MISC) https://launchpad.support.sap.com/#/notes/2234971 - Permissions Required

10 Nov 2021, 15:15

Type Values Removed Values Added
References
  • (MISC) https://launchpad.support.sap.com/#/notes/2234971 -

20 Apr 2021, 18:56

Type Values Removed Values Added
CPE cpe:2.3:a:sap:netweaver:7.10:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:7.20:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*		 cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*
References (MISC) https://erpscan.io/advisories/erpscan-16-012/ - (MISC) https://erpscan.io/advisories/erpscan-16-012/ - Third Party Advisory
References (MISC) http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html - (MISC) http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html - Exploit, Third Party Advisory, VDB Entry
References (FULLDISC) http://seclists.org/fulldisclosure/2016/Jun/40 - (FULLDISC) http://seclists.org/fulldisclosure/2016/Jun/40 - Exploit, Mailing List, Third Party Advisory
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/39996/ - (EXPLOIT-DB) https://www.exploit-db.com/exploits/39996/ - Exploit, Third Party Advisory, VDB Entry
References (MISC) https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/ - (MISC) https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/ - Third Party Advisory
Information

Published : 2016-04-07 23:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-3976

Mitre link : CVE-2016-3976

CVE.ORG link : CVE-2016-3976

JSON object : View

Products Affected

sap

  • netweaver_application_server_java
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')