CVE-2016-3635
HighSummary
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
Risk Assessment
The organization may be exposed to unauthorized code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update the system to the latest version and implement appropriate access control measures to minimize the risk of unauthorized access.
Other vulnerabilities in SAP Netweaver 7.4
See all- CVE-2017-9845High
Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.
- CVE-2015-5067High
The Cross-System Tools and Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
- CVE-2014-4003High
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
- CVE-2015-7241Critical
The XXE vulnerability in SAP Netweaver before version 7.01 allows an attacker to exploit external XML entities to gain access to system data.
- CVE-2016-10311Critical
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
- CVE-2026-58246Medium
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.
Original NVD description (English source)
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly, aka SAP Security Note 2139366.