vulnwire
9.8crit

CVE-2016-2386KEVin critical feed2 exploits

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2022-06-09
EPSS
71.5%
percentile 99%
Public exploits
2
Exploit-DB

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-06-30 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
SAP / NetWeaver
CISA name
SAP NetWeaver SQL Injection Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction (EPSS)

71.52% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-43495 SAP NetWeaver J2EE Engine 7.40 - SQL Injection · webapps · 2018-01-10
  • EDB-39840 SAP NetWeaver AS JAVA 7.1 < 7.5 - SQL Injection · webapps · 2016-05-19

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • erpscan.io /advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ · x_refsource_MISC, x_transferred
  • packetstormsecurity.com /files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/39840/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • github.com /vah13/SAP_exploit · x_refsource_MISC, x_transferred
  • erpscan.io /press-center/blog/sap-security-notes-february-2016-review/ · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/43495/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • seclists.org /fulldisclosure/2016/May/56 · mailing-list, x_refsource_FULLDISC, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.