CVE-2016-2386criticalunder attackCWE-89

CVE-2016-2386

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 72%
from disclosure to weapon93 days
Published on NVDFeb 16
1st PoC+93d
CISA KEV+2305d
Action required by CISAfederal deadline: 2022-06-30

Apply updates per vendor instructions.

In short

A flaw in SAP NetWeaver's UDDI server allows attackers to inject malicious SQL commands without authentication, potentially gaining complete access to the database and all sensitive data stored there.

Technical detail

SQL injection vulnerability in the UDDI server component of SAP NetWeaver J2EE Engine 7.40 exploited via unspecified input vectors, enabling unauthenticated remote code execution within the database context. Attack requires network access to the UDDI service; successful exploitation results in full database compromise including data exfiltration and modification.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.