CVE-2016-9562
HighSummary
SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, leading to a null pointer exception and icman outage.
Risk Assessment
Attackers can exploit this vulnerability to disrupt system operations, potentially leading to service downtime and loss of application availability.
Recommendation
It is recommended to update to the latest version of SAP NetWeaver AS JAVA and monitor logs for potential attack attempts.
Other vulnerabilities in SAP NetWeaver AS JAVA 7.4
See all- CVE-2017-7717High
CVE-2017-7717 is an SQL injection vulnerability in the getUserUddiElements method of the ES UDDI component in SAP NetWeaver AS Java 7.4. It allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2015-8840High
The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, allowing remote authenticated users to access sensitive information and gain privileges.
- CVE-2015-4091High
The XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers via an XML request to tc~sld~wd~main/Main, potentially leading to unspecified other impacts.
Original NVD description (English source)
SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835.