CVE-2016-3974

Critical

Published: 07/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS versions 7.1 to 7.5 allows remote attackers to cause denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request.

Risk Assessment

The organization may be exposed to attacks that could lead to service unavailability and unauthorized access to data.

Recommendation

It is recommended to update to the latest version of SAP NetWeaver Java AS and implement appropriate security measures to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.