Actively exploited · Published Apr 7, 2016 · Assigned by mitre

CVE-2016-3976

High 7.5 Exploited

In plain English

A high-severity path traversal in NetWeaver from SAP. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 47.3% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)47.3%top 1.2% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/ x_refsource_MISC
20160618 [ERPSCAN-16-012] SAP NetWeaver AS JAVA - directory traversal vulnerability mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html x_refsource_MISC
https://erpscan.io/advisories/erpscan-16-012/ x_refsource_MISC
39996 exploit, x_refsource_EXPLOIT-DB
https://launchpad.support.sap.com/#/notes/2234971 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3976 government-resource