Actively exploited in the wild
SAP NetWeaver XML External Entity (XXE) Vulnerability
SAP - NetWeaver · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2016-9563
MediumCVSS 6.5KEVSummary
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI (SAP Security Note 2296909).
Risk Assessment
An authenticated attacker can exploit XXE to read files, perform SSRF, or otherwise affect the SAP server, potentially leading to data exposure.
Recommendation
Apply SAP Security Note 2296909 and restrict access to the affected URI and user privileges.
Other vulnerabilities in SAP NetWeaver AS JAVA
See all- CVE-2017-7717High
CVE-2017-7717 is an SQL injection vulnerability in the getUserUddiElements method of the ES UDDI component in SAP NetWeaver AS Java 7.4. It allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-9562High
SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, leading to a null pointer exception and icman outage.
- CVE-2015-8840High
The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, allowing remote authenticated users to access sensitive information and gain privileges.
- CVE-2015-4091High
The XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers via an XML request to tc~sld~wd~main/Main, potentially leading to unspecified other impacts.
- CVE-2020-6287CriticalActively exploited
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
- CVE-2016-2388MediumActively exploited
A vulnerability in the Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, known as SAP Security Note 2256846.
Original NVD description (English source)
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.