CVE-2016-2386
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2022-06-09Remediation due 2022-06-30
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
9.8
CVSS
71.5%
EPSS (exploit prob.)
99th
EPSS percentile
2016-02-16
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sap | netweaver_application_server_java | 7.40 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
- http://seclists.org/fulldisclosure/2016/May/56
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
- https://github.com/vah13/SAP_exploit
- https://www.exploit-db.com/exploits/39840/
- https://www.exploit-db.com/exploits/43495/
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
- http://seclists.org/fulldisclosure/2016/May/56
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
- https://github.com/vah13/SAP_exploit
- https://www.exploit-db.com/exploits/39840/
- https://www.exploit-db.com/exploits/43495/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2016-2386