CVE-2016-9563

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-9563
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/92419 Broken Link Third Party Advisory VDB Entry
https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/ Third Party Advisory
https://launchpad.support.sap.com/#/notes/2296909 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
History

29 Apr 2022, 15:36

Type Values Removed Values Added
References (MISC) https://launchpad.support.sap.com/#/notes/2296909 - (MISC) https://launchpad.support.sap.com/#/notes/2296909 - Permissions Required
References (BID) http://www.securityfocus.com/bid/92419 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/92419 - Broken Link, Third Party Advisory, VDB Entry

10 Nov 2021, 15:15

Type Values Removed Values Added
References
  • (MISC) https://launchpad.support.sap.com/#/notes/2296909 -

20 Apr 2021, 18:32

Type Values Removed Values Added
CWE CWE-284 CWE-611
CPE cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
CVSS v2 : 6.0
v3 : 6.4 		v2 : 4.0
v3 : 6.5
References (MISC) https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/ - (MISC) https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/ - Third Party Advisory
Information

Published : 2016-11-23 02:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-9563

Mitre link : CVE-2016-9563

CVE.ORG link : CVE-2016-9563

JSON object : View

Products Affected

sap

  • netweaver_application_server_java
CWE
CWE-611

Improper Restriction of XML External Entity Reference