CVE-2016-4014

High

Published: 14/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a system hang by sending a crafted DTD in an XML request to uddi/api/replication.

Risk Assessment

Attackers can lead to system downtime, which may result in operational disruptions for the organization.

Recommendation

It is recommended to update to the latest version of SAP NetWeaver and implement appropriate protections against XXE attacks.

Other vulnerabilities in SAP NetWeaver JAVA AS 7.4

CVE-2016-4015High
The Enqueue Server in SAP NetWeaver JAVA AS versions 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request.

Original NVD description (English source)

XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389.