Find a vulnerability

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetWeaver (Internet Graphics Service) versions BC-FES-IGS 7.20EXT, 7.20_EXT2, 7.53, 7.54, 7.81 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP (Internet Communication Manager) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Objects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business Objects Business Intelligence Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "WebClient UI version S4FND 104 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver et ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server Java EDM Application version CE-RA-EDM 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server Java EDM Application",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server pour ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server pour ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Host Agent version SAPHOSTAGENT 7.22 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Host Agent",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "ABAP Developer Tools (AMDP Data Preview) versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 920 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "ABAP Developer Tools",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S4CRM versions S4CRM 204, 205, 206, S4CEXT 107, 108, 109, BBPCRM 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S4CRM",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Knowledge Management (XML Forms) version KMC-CM 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Knowledge Management",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "WebClient UI versions S4FND 104, 105 et 106 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server (Message Server) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Web Dispatcher versions KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Web Dispatcher",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Gateway versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Gateway",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Objects versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business Objects",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver (Message Server) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Enterprise Portal versions EP-BASIS 7.50, EP-BASIS-API 7.50, EP-RUNTIME 7.50 et EP-ADMIN 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Enterprise Portal",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Web Dispatcher et Internet Communication Manager versions WEBDISP 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, KERNEL 7.93, 9.16, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Web Dispatcher, Internet Communication Manager et Content Server",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver et ABAP Platform (Message Server) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Process Integration (Process Integration Test Tool) version SAP_XIPIT 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Process Integration",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Start Service et Microsoft Management Console versions HDB 2.00, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, CONTSERV 7.53, 7.54, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20 et MMC 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Start Service et Microsoft Management Console",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server Java (NWDI Cockpit) version DI_NTY 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server Java (Web Dynpro Java) version WD-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver et ABAP Platform (Application Server ABAP) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920 et SAP_BASIS 921 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Web Dispatcher versions HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Web Dispatcher",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Web Dispatcher et Internet Communication Manager versions KRNL64NUC 7.22,7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.93, 9.16, KERNEL 7.22,7.53, 7.54, 7.77, 7.93, 9.16, 9.18 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Web Dispatcher et Internet Communication Manager",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver et ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver et ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.22EX2, 7.22EX3, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP et ABAP Platform (SAML2 Service Provider) versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920, SAP_BASIS 921 et SAP_BASIS 922 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP (Internet Communication Manager) and Web Dispatcher versions WEBDISP 9.16, KERNEL 9.16, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Visual Composer version VC70RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Visual Composer",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP, ABAP Platform et Web Dispatcher versions WEBDISP 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.0, KERNEL 7.77, 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP/astonish version \u003c v3.6.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP/astonish",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server Java (Web Services) versions ENGINEAPI 7.50 et J2EE-FRMW 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver et ABAP Platform (Application Server ABAP) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.20 et 9.21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP (Applications based on GUI for HTML) versions SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Solution Tools Plug-In",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver (Internet Graphics Service) versions BC-FES-IGS 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-109794",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109794"
    },
    {
      "name": "CVE-2026-109800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109800"
    },
    {
      "name": "CVE-2026-120014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120014"
    },
    {
      "name": "CVE-2026-109805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109805"
    },
    {
      "name": "CVE-2026-89125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89125"
    },
    {
      "name": "CVE-2026-76973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76973"
    },
    {
      "name": "CVE-2026-109796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109796"
    },
    {
      "name": "CVE-2026-76976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76976"
    },
    {
      "name": "CVE-2026-109808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109808"
    },
    {
      "name": "CVE-2026-76966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76966"
    },
    {
      "name": "CVE-2026-120010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120010"
    },
    {
      "name": "CVE-2026-109802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109802"
    },
    {
      "name": "CVE-2026-109801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109801"
    },
    {
      "name": "CVE-2026-89114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89114"
    },
    {
      "name": "CVE-2026-120016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120016"
    },
    {
      "name": "CVE-2026-120009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120009"
    },
    {
      "name": "CVE-2026-76970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76970"
    },
    {
      "name": "CVE-2026-109810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109810"
    },
    {
      "name": "CVE-2026-109806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109806"
    },
    {
      "name": "CVE-2026-120008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120008"
    },
    {
      "name": "CVE-2026-89131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89131"
    },
    {
      "name": "CVE-2026-109793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109793"
    },
    {
      "name": "CVE-2026-109798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109798"
    },
    {
      "name": "CVE-2026-120017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120017"
    },
    {
      "name": "CVE-2026-89128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89128"
    },
    {
      "name": "CVE-2026-109807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109807"
    },
    {
      "name": "CVE-2026-89126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89126"
    },
    {
      "name": "CVE-2026-89119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89119"
    },
    {
      "name": "CVE-2026-109797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109797"
    },
    {
      "name": "CVE-2026-109804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109804"
    },
    {
      "name": "CVE-2026-120012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120012"
    },
    {
      "name": "CVE-2026-73635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73635"
    },
    {
      "name": "CVE-2026-109795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109795"
    },
    {
      "name": "CVE-2026-120013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120013"
    },
    {
      "name": "CVE-2026-76965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76965"
    },
    {
      "name": "CVE-2026-76964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76964"
    },
    {
      "name": "CVE-2026-89129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89129"
    },
    {
      "name": "CVE-2026-44768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44768"
    },
    {
      "name": "CVE-2026-89115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89115"
    },
    {
      "name": "CVE-2026-109803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109803"
    },
    {
      "name": "CVE-2026-89103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89103"
    },
    {
      "name": "CVE-2026-109811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109811"
    },
    {
      "name": "CVE-2026-109799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109799"
    },
    {
      "name": "CVE-2026-120015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120015"
    },
    {
      "name": "CVE-2026-109809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109809"
    }
  ],
  "initial_release_date": "2026-11-10T00:00:00",
  "last_revision_date": "2026-11-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1497",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-11-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2026-11-10",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP november-2026",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201611-0385",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "92419"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "92419"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-9563",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2016-9563",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 6.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2016-9563",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2016-9563",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 6.4,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2016-9563",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-9563",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2016-9563",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-9563",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201611-535",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-9563",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909. Vendors have confirmed this vulnerability SAP Security Note 2296909 It is released as. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. \nAn attacker can exploit this issue to cause a denial of service condition",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "BID",
        "id": "92419"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-9563"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-9563",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "92419",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-9563",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "db": "BID",
        "id": "92419"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "id": "VAR-201611-0385",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-11-18T15:34:41.946000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Cyber Threat Intelligence report - August 2016 (2296909)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2016/08/10/sap-cyber-threat-intelligence-report-august-2016/"
      },
      {
        "title": "SAP NetWeaver Application Server Java Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65870"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2021/04/06/sap_patch_attacks/"
      },
      {
        "title": "Known Exploited Vulnerabilities Detector",
        "trust": 0.1,
        "url": "https://github.com/Ostorlab/KEV "
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/sap-bugs-cyberattack-compromise/165265/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/92419"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/"
      },
      {
        "trust": 1.7,
        "url": "https://launchpad.support.sap.com/#/notes/2296909"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2016-9563"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9563"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-9563"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com/"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2296909"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/611.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2021/04/06/sap_patch_attacks/"
      },
      {
        "trust": 0.1,
        "url": "https://threatpost.com/sap-bugs-cyberattack-compromise/165265/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "db": "BID",
        "id": "92419"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "db": "BID",
        "id": "92419"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-11-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "date": "2016-08-10T00:00:00",
        "db": "BID",
        "id": "92419"
      },
      {
        "date": "2016-08-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "date": "2016-11-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "date": "2016-11-23T02:59:06.370000",
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-04-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-9563"
      },
      {
        "date": "2016-11-24T00:16:00",
        "db": "BID",
        "id": "92419"
      },
      {
        "date": "2021-11-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      },
      {
        "date": "2016-11-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      },
      {
        "date": "2025-10-22T00:15:57.253000",
        "db": "NVD",
        "id": "CVE-2016-9563"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA of  BC-BMT-BPM-DSK In  XML External entity attack vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005937"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-535"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201605-0004",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver sp15",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "netweaver sp8",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.02"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.01"
      },
      {
        "model": "netweaver application server java",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.3"
      },
      {
        "model": "solution manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "supply chain management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "product lifecycle management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver composition environment",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "exchange infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "enterprise portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver sp15",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "sap",
        "version": "7.0*"
      },
      {
        "model": "netweaver sp8",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "sap",
        "version": "7.0*"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "sap",
        "version": "7.10*"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "sap",
        "version": "7.30*"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "sap",
        "version": "7.02*"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "sap",
        "version": "7.01*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "BID",
        "id": "90533"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_java_application_server",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Onapsis Security",
    "sources": [
      {
        "db": "BID",
        "id": "90533"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      }
    ],
    "trust": 1.2
  },
  "cve": "CVE-2010-5326",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2010-5326",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": null,
            "accessVector": null,
            "authentication": null,
            "author": "IVD",
            "availabilityImpact": null,
            "baseScore": null,
            "confidentialityImpact": null,
            "exploitabilityScore": null,
            "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d",
            "impactScore": null,
            "integrityImpact": null,
            "severity": null,
            "trust": 0.2,
            "vectorString": null,
            "version": "unknown"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2010-5326",
            "impactScore": 6.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 10.0,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2010-5326",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2010-5326",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2010-5326",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2010-5326",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201605-399",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "IVD",
            "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2010-5326",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a \"Detour\" attack. Attacks on this vulnerability 2013 From 2016 Observed in year. This vulnerability \"Detour\" It is called an attack. Vendors have confirmed this vulnerability SAP Security Note 1445998 It is released as.By a third party HTTP Or HTTPS Arbitrary code may be executed via a request. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. The SAP Netweaver Invoker Servlet has a security vulnerability that allows an attacker to call any servlet even if it is declared in a web.xml file. This includes any servlet classes available in the application classloader, such as those in the WEB-INF\\\\classes, WEB-INF\\\\lib, and WEB-INF\\\\additinal-lib application directories. Multiple servlets included with Java applications are not designed for direct client access, but instead interact inside the application, thus causing arbitrary calls to be performed and invisible operations on the SAP server. \nAn attacker may leverage this issue to execute arbitrary script code within the context of the affected application",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "BID",
        "id": "90533"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326"
      }
    ],
    "trust": 2.97
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "48925",
        "trust": 3.2
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326",
        "trust": 2.8
      },
      {
        "db": "USCERT",
        "id": "TA16-132A",
        "trust": 2.5
      },
      {
        "db": "BID",
        "id": "90533",
        "trust": 2.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399",
        "trust": 0.6
      },
      {
        "db": "IVD",
        "id": "39506C1A-1F8E-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "db": "BID",
        "id": "90533"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "id": "VAR-201605-0004",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      }
    ],
    "trust": 1.313308068
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      }
    ]
  },
  "last_update_date": "2025-11-18T15:33:21.734000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Invoker Servlet",
        "trust": 0.8,
        "url": "http://help.sap.com/saphelp_nw70ehp2/helpdata/en/bb/f2b9d88ba4e8459e5a69cb513597ec/frameset.htm"
      },
      {
        "title": "US-CERT \u30a2\u30e9\u30fc\u30c8\u60c5\u5831\uff1aSAP \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ce\u30fc\u30c8 1445998 \u3067\u89e3\u6c7a\u6e08\u307f\u306e\u554f\u984c\u306b\u3064\u3044\u3066\u518d\u5ea6\u306e\u304a\u77e5\u3089\u305b",
        "trust": 0.8,
        "url": "https://support.sap.com/ja.html"
      },
      {
        "title": "Patch for SAP Netweaver Invoker Servlet Remote Code Execution Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/4568"
      },
      {
        "title": "SAP NetWeaver Application Server Invoker Servlet Fixes for arbitrary code execution vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61715"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2021/04/06/sap_patch_attacks/"
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/sap-bugs-cyberattack-compromise/165265/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-306",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications"
      },
      {
        "trust": 2.5,
        "url": "http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions"
      },
      {
        "trust": 2.5,
        "url": "http://www.us-cert.gov/ncas/alerts/ta16-132a"
      },
      {
        "trust": 2.3,
        "url": "http://www.securityfocus.com/bid/48925"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/90533"
      },
      {
        "trust": 1.7,
        "url": "http://service.sap.com/sap/support/notes/1445998"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2010-5326"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-5326"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/ta/jvnta91951276/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-5326"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/48925/info"
      },
      {
        "trust": 0.6,
        "url": "http://www.onapsis.com/resources/download.php?id=7wkeuqheij%2bqq3jv4qpdjl1ffrxqqxpj5uloink%2bzeilka6bds1fhqzomd%2bpokyossoouymyxkdykay2dgrh\u0026lang=en ."
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com/platform/netweaver/index.epx"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2021/04/06/sap_patch_attacks/"
      },
      {
        "trust": 0.1,
        "url": "https://threatpost.com/sap-bugs-cyberattack-compromise/165265/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "db": "BID",
        "id": "90533"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "db": "BID",
        "id": "90533"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2011-07-29T00:00:00",
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2011-07-29T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "date": "2016-05-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "date": "2016-05-11T00:00:00",
        "db": "BID",
        "id": "90533"
      },
      {
        "date": "2011-07-28T00:00:00",
        "db": "BID",
        "id": "48925"
      },
      {
        "date": "1900-01-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      },
      {
        "date": "2016-05-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "date": "2016-05-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "date": "2016-05-13T10:59:00.173000",
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2011-07-29T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "date": "2021-04-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2010-5326"
      },
      {
        "date": "2016-07-05T22:21:00",
        "db": "BID",
        "id": "90533"
      },
      {
        "date": "2011-07-28T00:00:00",
        "db": "BID",
        "id": "48925"
      },
      {
        "date": "2011-08-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      },
      {
        "date": "2016-05-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002737"
      },
      {
        "date": "2025-10-22T00:15:38.523000",
        "db": "NVD",
        "id": "CVE-2010-5326"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201605-399"
      }
    ],
    "trust": 1.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP Netweaver Invoker Servlet Remote code execution vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2011-2905"
      },
      {
        "db": "BID",
        "id": "48925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      }
    ],
    "trust": 1.7
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Code injection",
    "sources": [
      {
        "db": "IVD",
        "id": "39506c1a-1f8e-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-453"
      }
    ],
    "trust": 0.8
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201708-0889",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.50"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_java_application_server",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      }
    ]
  },
  "cve": "CVE-2017-12637",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-12637",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-12637",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-12637",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-12637",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2017-12637",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-12637",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201708-277",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-12637",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. Attacks on this vulnerability 2017 Year 8 Observed on the moon. Vendors have confirmed this vulnerability SAP Security Note 2486657 It is released as.Information may be obtained",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-12637"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-12637",
        "trust": 2.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-12637",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "id": "VAR-201708-0889",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-11-18T15:33:20.957000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "August 2017 (2486657)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2017/08/08/sap-security-patch-day-august-2017/"
      },
      {
        "title": "Nuclei Templates\nResources",
        "trust": 0.1,
        "url": "https://github.com/merlinepedra25/nuclei-templates "
      },
      {
        "title": "Nuclei Templates\nResources",
        "trust": 0.1,
        "url": "https://github.com/merlinepedra/nuclei-templates "
      },
      {
        "title": "Kenzer Templates [1289]",
        "trust": 0.1,
        "url": "https://github.com/Elsfa7-110/kenzer-templates "
      },
      {
        "title": "Kenzer Templates [5170] [DEPRECATED]",
        "trust": 0.1,
        "url": "https://github.com/ARPSyndicate/kenzer-templates "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.0,
        "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2017-12637"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12637"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12637"
      },
      {
        "trust": 0.8,
        "url": "https://www.onapsis.com/blog/sap-security-notes-august-2017-remote-code-injection-vulnerability-java-component"
      },
      {
        "trust": 0.7,
        "url": "http://www.sh0w.top/index.php/archives/7/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/22.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/merlinepedra25/nuclei-templates"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/arpsyndicate/kenzer-templates"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "date": "2017-08-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "date": "2017-09-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "date": "2017-08-07T20:29:01.120000",
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-02-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-12637"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "date": "2017-09-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      },
      {
        "date": "2025-10-22T00:16:04.740000",
        "db": "NVD",
        "id": "CVE-2017-12637"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver Application Server Java Path traversal vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006983"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-277"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201604-0660",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.1 to  7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "85946"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-3976",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-3976",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-3976",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2016-3976",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-3976",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2016-3976",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-3976",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201604-099",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-3976",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971. SAP NetWeaver AS Java Contains a directory traversal vulnerability. SAP NetWeaver is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. \nRemote attackers can use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to retrieve arbitrary files in the context of the application.            This may aid in further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "BID",
        "id": "85946"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      }
    ],
    "trust": 1.98
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=39996",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-3976",
        "trust": 2.8
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39996",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "137528",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "85946",
        "trust": 0.4
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-3976",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "db": "BID",
        "id": "85946"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "id": "VAR-201604-0660",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-11-18T15:28:46.094000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Note 2234971",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/DOC-55451"
      },
      {
        "title": "SAP NetWeaver AS Java Fixes for directory traversal vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60830"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2021/04/06/sap_patch_attacks/"
      },
      {
        "title": "Known Exploited Vulnerabilities Detector",
        "trust": 0.1,
        "url": "https://github.com/Ostorlab/KEV "
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/sap-bugs-cyberattack-compromise/165265/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://www.exploit-db.com/exploits/39996/"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2016/jun/40"
      },
      {
        "trust": 1.7,
        "url": "http://packetstormsecurity.com/files/137528/sap-netweaver-as-java-7.5-directory-traversal.html"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/advisories/erpscan-16-012/"
      },
      {
        "trust": 1.7,
        "url": "https://launchpad.support.sap.com/#/notes/2234971"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2016-3976"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3976"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3976"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-16-012/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/22.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://threatpost.com/sap-bugs-cyberattack-compromise/165265/"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/85946"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "db": "BID",
        "id": "85946"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-04-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "date": "2016-04-07T00:00:00",
        "db": "BID",
        "id": "85946"
      },
      {
        "date": "2016-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "date": "2016-04-07T23:59:10.797000",
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-04-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-3976"
      },
      {
        "date": "2016-07-05T22:40:00",
        "db": "BID",
        "id": "85946"
      },
      {
        "date": "2021-11-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      },
      {
        "date": "2016-08-31T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      },
      {
        "date": "2025-10-22T00:15:52.260000",
        "db": "NVD",
        "id": "CVE-2016-3976"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java Vulnerable to directory traversal",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002003"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-099"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201602-0120",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.4"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      }
    ]
  },
  "cve": "CVE-2016-2388",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-2388",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-2388",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-2388",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2016-2388",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-2388",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201602-298",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-2388",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Vendors have confirmed this vulnerability SAP Security Note 2256846 It is released as. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlSkillfully crafted by a third party HTTP Important user information may be obtained through a request",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      }
    ],
    "trust": 1.71
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=39841",
        "trust": 0.2,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-2388",
        "trust": 2.5
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39841",
        "trust": 1.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "43495",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "137128",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "145860",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "83219",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-2388",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "id": "VAR-201602-0120",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-11-18T15:22:24.804000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Notes February 2016 - Review (2256846)",
        "trust": 0.8,
        "url": "http://scn.sap.com/community/security/blog/2016/02/11/sap-security-notes-february-2016--review?TB_iframe=true\u0026width=921.6\u0026height=921.6"
      },
      {
        "title": "SAP NetWeaver Universal Worklist Configuration Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60234"
      },
      {
        "title": "SAP_exploit",
        "trust": 0.1,
        "url": "https://github.com/vah13/SAP_exploit "
      },
      {
        "title": "Exp101tsArchiv30thers",
        "trust": 0.1,
        "url": "https://github.com/nu11secur1ty/Exp101tsArchiv30thers "
      },
      {
        "title": "awesome-cve-poc_qazbnm456",
        "trust": 0.1,
        "url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
      },
      {
        "title": "The Register",
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2022/06/15/microsoft_patch_tuesday/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://www.exploit-db.com/exploits/39841/"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2016/may/55"
      },
      {
        "trust": 1.7,
        "url": "http://packetstormsecurity.com/files/137128/sap-netweaver-as-java-7.5-information-disclosure.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.exploit-db.com/exploits/43495/"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/"
      },
      {
        "trust": 1.7,
        "url": "http://packetstormsecurity.com/files/145860/sap-netweaver-j2ee-engine-7.40-sql-injection.html"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2016-2388"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-2388"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-2388"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/press-center/blog/sap-security-notes-february-2016-review/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/200.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/vah13/sap_exploit"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/83219"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-02-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "date": "2016-02-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "date": "2016-03-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "date": "2016-02-16T15:59:02.103000",
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-05-05T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-2388"
      },
      {
        "date": "2021-04-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      },
      {
        "date": "2016-03-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      },
      {
        "date": "2025-10-22T00:15:50.140000",
        "db": "NVD",
        "id": "CVE-2016-2388"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver of  Universal Worklist Configuration Vulnerability in obtaining important user information",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001526"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-298"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201602-0118",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "j2ee engine 7.40"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      }
    ]
  },
  "cve": "CVE-2016-2386",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-2386",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-2386",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-2386",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2016-2386",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-2386",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201602-296",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-2386",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      }
    ],
    "trust": 1.71
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=39840",
        "trust": 0.2,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-2386",
        "trust": 2.5
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39840",
        "trust": 1.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "43495",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "137129",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "83222",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-2386",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "id": "VAR-201602-0118",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-11-18T15:22:24.777000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Notes February 2016 - Review (2101079)",
        "trust": 0.8,
        "url": "http://scn.sap.com/community/security/blog/2016/02/11/sap-security-notes-february-2016--review?TB_iframe=true\u0026width=921.6\u0026height=921.6"
      },
      {
        "title": "SAP NetWeaver J2EE Engine UDDI server SQL Repair measures for injecting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60232"
      },
      {
        "title": "https://github.com/murataydemir/CVE-2016-2386",
        "trust": 0.1,
        "url": "https://github.com/murataydemir/CVE-2016-2386 "
      },
      {
        "title": "SAP_exploit",
        "trust": 0.1,
        "url": "https://github.com/vah13/SAP_exploit "
      },
      {
        "title": "Awesome CVE PoC",
        "trust": 0.1,
        "url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
      },
      {
        "title": "Awesome CVE PoC",
        "trust": 0.1,
        "url": "https://github.com/lnick2023/nicenice "
      },
      {
        "title": "Known Exploited Vulnerabilities Detector",
        "trust": 0.1,
        "url": "https://github.com/Ostorlab/KEV "
      },
      {
        "title": "Awesome CVE PoC",
        "trust": 0.1,
        "url": "https://github.com/qazbnm456/awesome-cve-poc "
      },
      {
        "title": "The Register",
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2022/06/15/microsoft_patch_tuesday/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-89",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://www.exploit-db.com/exploits/39840/"
      },
      {
        "trust": 1.8,
        "url": "https://github.com/vah13/sap_exploit"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2016/may/56"
      },
      {
        "trust": 1.7,
        "url": "http://packetstormsecurity.com/files/137129/sap-netweaver-as-java-7.5-sql-injection.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.exploit-db.com/exploits/43495/"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2016-2386"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-2386"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-2386"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/press-center/blog/sap-security-notes-february-2016-review/"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/89.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/murataydemir/cve-2016-2386"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/83222"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-02-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "date": "2016-02-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "date": "2016-02-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "date": "2016-02-16T15:59:00.133000",
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-2386"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      },
      {
        "date": "2016-02-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      },
      {
        "date": "2025-10-22T00:15:49.967000",
        "db": "NVD",
        "id": "CVE-2016-2386"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver J2EE Engine of  UDDI On the server  SQL Injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-001461"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SQL injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201602-296"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201709-0547",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.00"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.0 to  7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.03"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.02"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.01"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.3"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_java_application_server",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      }
    ]
  },
  "cve": "CVE-2017-14581",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-14581",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-14581",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2017-14581",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-14581",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-14581",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201709-799",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181. SAP NetWeaver AS JAVA Contains a resource exhaustion vulnerability. Vendors have confirmed this vulnerability SAP Security Note 2389181 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-14581",
        "trust": 2.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "id": "VAR-201709-0547",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:38:27.569000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "June 2017 (2389181)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2017/06/13/sap-security-patch-day-june2017/"
      },
      {
        "title": "SAP NetWeaver Application Server JAVA Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74963"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-400",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-17-030-sap-hostcontrol-remote-dos/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14581"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14581"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-17-030-sap-hostcontrol-remote-dos/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-10-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "date": "2017-09-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "date": "2017-09-19T16:29:00.403000",
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-10-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-14581"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA Vulnerable to resource exhaustion",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-008409"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "lack of information",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-799"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201707-0530",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "as java 7.5"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "knowledge management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97572"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP",
    "sources": [
      {
        "db": "BID",
        "id": "97572"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-11457",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2017-11457",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-11457",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-11457",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-11457",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-11457",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201707-872",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249. SAP NetWeaver AS JAVA Is XML An external entity vulnerability exists. Vendors have confirmed this vulnerability SAP Security Note 2387249 It is released as.Information may be obtained. \nAttackers can exploit this  issue to gain access to sensitive information or cause denial-of-service conditions",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "BID",
        "id": "97572"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-11457",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "97572",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97572"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "id": "VAR-201707-0530",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:32:11.355000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "April 2017 (2387249)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2017/04/12/sap-cyber-threat-intelligence-report-april-2017/"
      },
      {
        "title": "SAP NetWeaver AS JAVA Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148143"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-17-018-sap-netweaver-java-7-5-xxe-com-sap-km-cm-ice/"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/97572"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/advisories/erpscan-17-018-sap-netweaver-java-7-5-xxe-com-sap-km-cm-ice/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11457"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-11457"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com/"
      },
      {
        "trust": 0.3,
        "url": "https://launchpad.support.sap.com/#/notes/2387249"
      },
      {
        "trust": 0.3,
        "url": "https://blogs.sap.com/2017/04/11/sap-security-patch-day-april-2017/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97572"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "97572"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-04-11T00:00:00",
        "db": "BID",
        "id": "97572"
      },
      {
        "date": "2017-09-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "date": "2017-07-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "date": "2017-07-25T18:29:01.103000",
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-25T12:11:00",
        "db": "BID",
        "id": "97572"
      },
      {
        "date": "2017-09-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-11457"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA In  XML External entity vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006832"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-872"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201704-1577",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "sso authentication library",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": "2.0"
      },
      {
        "model": "sso authentication library",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": "3.0"
      },
      {
        "model": "as java sso authentication library",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "2.0 to  3.0"
      },
      {
        "model": "single sign on",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:sso_authentication_library",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Onapsis Research Labs",
    "sources": [
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-7696",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-7696",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-7696",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-7696",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-7696",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201704-559",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_resources/qr, aka SAP Security Note 2389042. SAP Single Sign On is prone to a denial-of-service vulnerability. \nAn attacker can exploit this issue to cause denial-of-service conditions",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "BID",
        "id": "95363"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-7696",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "95363",
        "trust": 0.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "id": "VAR-201704-1577",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:27:25.070000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.sap.com/japan/index.html"
      },
      {
        "title": "SAP AS JAVA SSO Authentication Library Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=69192"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-770",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-399",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://erpscan.com/advisories/erpscan-17-001-sap-java-dos-bc-iam-sso-otp-package-use-qr-servlet/"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-17-001-sap-java-dos-bc-iam-sso-otp-package-use-qr-servlet/"
      },
      {
        "trust": 0.9,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.9,
        "url": "https://www.onapsis.com/blog/sap-security-notes-january-2017-continued-security-focus-sap-defense"
      },
      {
        "trust": 0.9,
        "url": "https://launchpad.support.sap.com/#/notes/2389042"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7696"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7696"
      },
      {
        "trust": 0.6,
        "url": "https://www.securityfocus.com/bid/95363"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-01-10T00:00:00",
        "db": "BID",
        "id": "95363"
      },
      {
        "date": "2017-05-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "date": "2017-04-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "date": "2017-04-14T18:59:01.080000",
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-04-12T21:00:00",
        "db": "BID",
        "id": "95363"
      },
      {
        "date": "2017-05-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-7696"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP AS JAVA SSO Authentication Library Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003212"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "resource management error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-559"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201704-1563",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "as java 7.4"
      },
      {
        "model": "customer relationship management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vahagn Vardanyan (ERPScan)",
    "sources": [
      {
        "db": "BID",
        "id": "95364"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-7717",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2017-7717",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-7717",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.2,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-7717",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-7717",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-7717",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201704-820",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504. SAP NetWeaver is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. \nAn attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. \nSAP NetWeaver 7.40 is vulnerable; other versions may also be affected",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-7717",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "100168",
        "trust": 1.9
      },
      {
        "db": "BID",
        "id": "95364",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "id": "VAR-201704-1563",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:22:22.883000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.sap.com/index.html"
      },
      {
        "title": "SAP NetWeaver AS Java ES UDDI SQL Repair measures for injecting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70235"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-89",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "http://www.securityfocus.com/bid/100168"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-17-003-sap-netweaver-7-4-getuseruddielements-sql-injection/"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/95364"
      },
      {
        "trust": 1.2,
        "url": "http://www.sap.com"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/advisories/erpscan-17-003-sap-netweaver-7-4-getuseruddielements-sql-injection/"
      },
      {
        "trust": 0.9,
        "url": "https://launchpad.support.sap.com/#/notes/2450979"
      },
      {
        "trust": 0.9,
        "url": "https://blogs.sap.com/2017/08/08/sap-security-patch-day-august-2017/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7717"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7717"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2356504"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-08T00:00:00",
        "db": "BID",
        "id": "100168"
      },
      {
        "date": "2017-01-10T00:00:00",
        "db": "BID",
        "id": "95364"
      },
      {
        "date": "2017-05-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "date": "2017-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "date": "2017-04-14T18:59:01.110000",
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-04-15T19:00:00",
        "db": "BID",
        "id": "100168"
      },
      {
        "date": "2017-04-18T00:06:00",
        "db": "BID",
        "id": "95364"
      },
      {
        "date": "2017-05-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201704-820"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-7717"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java of  ES UDDI Component  getUserUddiElements In the method  SQL Injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003171"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Input Validation Error",
    "sources": [
      {
        "db": "BID",
        "id": "100168"
      },
      {
        "db": "BID",
        "id": "95364"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201704-0088",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "as java 7.5"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "91733"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mathieu Geli (ERPScan)",
    "sources": [
      {
        "db": "BID",
        "id": "91733"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-10304",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2016-10304",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "id": "CVE-2016-10304",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2016-10304",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-10304",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-10304",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201703-1306",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788. SAP NetWeaver is prone to a denial-of-service vulnerability. \nAn attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "BID",
        "id": "91733"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-10304",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "91733",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "91733"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "id": "VAR-201704-0088",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:16:11.857000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.sap.com/index.html"
      },
      {
        "title": "SAP NetWeaver Application Server Java Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148141"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-502",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-16-029-sap-netweaver-java-7-5-deserialization-untrusted-user-value-trustmanagementservlet/"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/advisories/erpscan-16-029-sap-netweaver-java-7-5-deserialization-untrusted-user-value-trustmanagementservlet/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-10304"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-10304"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2315788"
      },
      {
        "trust": 0.3,
        "url": "https://erpscan.com/press-center/blog/sap-cyber-threat-intelligence-report-july-2016/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "91733"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "91733"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-07-12T00:00:00",
        "db": "BID",
        "id": "91733"
      },
      {
        "date": "2017-05-15T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "date": "2017-03-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "date": "2017-04-10T14:59:00.187000",
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-04-11T00:04:00",
        "db": "BID",
        "id": "91733"
      },
      {
        "date": "2017-05-15T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      },
      {
        "date": "2021-04-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2016-10304"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA of  SAP EP-RUNTIME Service disruption in components  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-008306"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201703-1306"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201705-4094",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "as java 7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "visual composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "96204"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "ERPScan",
    "sources": [
      {
        "db": "BID",
        "id": "96204"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-8913",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2017-8913",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-8913",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-8913",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-8913",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-8913",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201705-660",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873. SAP Netweaver Visual Composer is prone to an information disclosure vulnerability. \nAttackers can exploit this issue to obtain sensitive information that may aid in launching further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "BID",
        "id": "96204"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-8913",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "96204",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "96204"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "id": "VAR-201705-4094",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:13:06.451000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.sap.com/index.html"
      },
      {
        "title": "SAP NetWeaver AS JAVA Visual Composer VC70RUNTIME Fixes for component security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70291"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-17-007-sap-netweaver-java-7-5-xxe-visual-composer-vc70runtime/"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8913"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-8913"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-17-007-sap-netweaver-java-7-5-xxe-visual-composer-vc70runtime/"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com/"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2386873"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "96204"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "96204"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-02-14T00:00:00",
        "db": "BID",
        "id": "96204"
      },
      {
        "date": "2017-06-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "date": "2017-05-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "date": "2017-05-23T04:29:02.243000",
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-05-23T18:00:00",
        "db": "BID",
        "id": "96204"
      },
      {
        "date": "2017-06-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-8913"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA of  Visual Composer VC70RUNTIME In the component  XML External entity attack vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004275"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-660"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201707-0531",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "sap",
        "version": "7.3"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "as java 7.3"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.30"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97566"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "97566"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-11458",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-11458",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 3.5,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2017-11458",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Low",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-11458",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.4,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2017-11458",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "Low",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-11458",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-11458",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201707-871",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783. Vendors have confirmed this vulnerability SAP Security Note 2406783 It is released as.Information may be obtained and information may be altered. \nRemote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the  context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "BID",
        "id": "97566"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-11458",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "97566",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97566"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "id": "VAR-201707-0531",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-20T23:13:04.279000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "April 2017 (2406783)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2017/04/11/sap-security-patch-day-april-2017/"
      },
      {
        "title": "SAP NetWeaver AS JAVA Repair measures for cross-site scripting security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148142"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/97566"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-17-017-sap-netweaver-java-7-3-java-xss-ctcprotocolprotocol-servlet/"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/advisories/erpscan-17-017-sap-netweaver-java-7-3-java-xss-ctcprotocolprotocol-servlet/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11458"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-11458"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2406783"
      },
      {
        "trust": 0.3,
        "url": "https://blogs.sap.com/2017/04/11/sap-security-patch-day-april-2017/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97566"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "97566"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-04-11T00:00:00",
        "db": "BID",
        "id": "97566"
      },
      {
        "date": "2017-09-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "date": "2017-07-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "date": "2017-07-25T18:29:01.133000",
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-25T13:11:00",
        "db": "BID",
        "id": "97566"
      },
      {
        "date": "2017-09-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-11458"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006731"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-871"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201604-0103",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.1 to  7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vahagn Vardanyan (ERPScan)",
    "sources": [
      {
        "db": "BID",
        "id": "85945"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-3975",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2016-3975",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2016-3975",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2016-3975",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-3975",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-3975",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201604-096",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP Security Note 2238375. \nRemote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the  context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. \nSAP NetWeaver 7.4 is vulnerable; other versions may also be affected",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "BID",
        "id": "85945"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-3975",
        "trust": 2.7
      },
      {
        "db": "PACKETSTORM",
        "id": "137529",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "85945",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "85945"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "id": "VAR-201604-0103",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-13T23:39:00.168000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Note 2238375",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/DOC-55451"
      },
      {
        "title": "SAP NetWeaver AS Java Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60827"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-16-014-sap-netweaver-7-4-navigationurltester/"
      },
      {
        "trust": 1.6,
        "url": "http://packetstormsecurity.com/files/137529/sap-netweaver-as-java-7.5-cross-site-scripting.html"
      },
      {
        "trust": 1.6,
        "url": "http://seclists.org/fulldisclosure/2016/jun/42"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3975"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3975"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-16-014-sap-netweaver-7-4-navigationurltester/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "85945"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-08T00:00:00",
        "db": "BID",
        "id": "85945"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "date": "2016-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "date": "2016-04-07T19:59:06.087000",
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-08T00:00:00",
        "db": "BID",
        "id": "85945"
      },
      {
        "date": "2016-08-31T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2016-3975"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002002"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-096"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201611-0319",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "sap",
        "version": "7.4"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "single sign on",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Onapsis Research Labs,Vahagn Vardanyan from ERPScan.",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2016-9562",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-9562",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-9562",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2016-9562",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-9562",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-9562",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201611-534",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-9562",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835. Vendors have confirmed this vulnerability SAP Security Note 2313835 It is released as. Supplementary information : CWE Vulnerability type by CWE-476: NULL Pointer Dereference (NULL Pointer dereference ) Has been identified. SAP NetWeaver Application Server Java is prone to a denial-of-service vulnerability. \nAn attacker can exploit this issue to cause denial-of-service conditions. \nSAP NetWeaver Application Server Java 7.4 is vulnerable",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-9562"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-9562",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "95363",
        "trust": 2.0
      },
      {
        "db": "BID",
        "id": "92418",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-9562",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "id": "VAR-201611-0319",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-13T23:31:23.599000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Cyber Threat Intelligence report - August 2016 (2313835)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2016/08/10/sap-cyber-threat-intelligence-report-august-2016/"
      },
      {
        "title": "SAP NetWeaver Application Server Java Remediation measures for denial of service vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65869"
      },
      {
        "title": "SAP_vulnerabilities",
        "trust": 0.1,
        "url": "https://github.com/vah13/SAP_vulnerabilities "
      },
      {
        "title": "radamsa-Fuzzer",
        "trust": 0.1,
        "url": "https://github.com/sunzu94/radamsa-Fuzzer "
      },
      {
        "title": "RADAMSA",
        "trust": 0.1,
        "url": "https://github.com/StephenHaruna/RADAMSA "
      },
      {
        "title": "radamsa",
        "trust": 0.1,
        "url": "https://github.com/Hwangtaewon/radamsa "
      },
      {
        "title": "radamsa",
        "trust": 0.1,
        "url": "https://github.com/benoit-a/radamsa "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-476",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "http://www.securityfocus.com/bid/95363"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/92418"
      },
      {
        "trust": 1.7,
        "url": "https://erpscan.io/advisories/erpscan-16-033-sap-netweaver-java-icman-dos-vulnerability/"
      },
      {
        "trust": 1.2,
        "url": "http://www.sap.com"
      },
      {
        "trust": 1.1,
        "url": "https://erpscan.com/advisories/erpscan-16-033-sap-netweaver-java-icman-dos-vulnerability/"
      },
      {
        "trust": 0.9,
        "url": "https://www.onapsis.com/blog/sap-security-notes-january-2017-continued-security-focus-sap-defense"
      },
      {
        "trust": 0.9,
        "url": "https://erpscan.com/advisories/erpscan-17-001-sap-java-dos-bc-iam-sso-otp-package-use-qr-servlet/"
      },
      {
        "trust": 0.9,
        "url": "https://launchpad.support.sap.com/#/notes/2389042"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9562"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-9562"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2313835"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/476.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/vah13/sap_vulnerabilities"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-11-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "date": "2016-08-08T00:00:00",
        "db": "BID",
        "id": "92418"
      },
      {
        "date": "2017-01-10T00:00:00",
        "db": "BID",
        "id": "95363"
      },
      {
        "date": "2016-11-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "date": "2016-08-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "date": "2016-11-23T02:59:05.150000",
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-9562"
      },
      {
        "date": "2016-11-24T00:16:00",
        "db": "BID",
        "id": "92418"
      },
      {
        "date": "2019-04-12T21:00:00",
        "db": "BID",
        "id": "95363"
      },
      {
        "date": "2016-11-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201611-534"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2016-9562"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005936"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Failure to Handle Exceptional Conditions",
    "sources": [
      {
        "db": "BID",
        "id": "92418"
      },
      {
        "db": "BID",
        "id": "95363"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201506-0132",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "maxdb",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "maxdb",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "sap",
        "version": "7.6"
      },
      {
        "model": "netweaver rfc sdk",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver abap application server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "gui",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver java application server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "rfc library",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "*"
      },
      {
        "model": "gui",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver application server abap",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver application server java",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver rfc sdk",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "\\u3000"
      },
      {
        "model": "rfc library",
        "scope": null,
        "trust": 0.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "sapcar archive tool",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "rfc sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver rfc sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver application server abap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "maxdb database",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "gui",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:gui",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:maxdb",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_abap_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_java_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_rfc_sdk",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Martin Gallo of Core Security Consulting Services.",
    "sources": [
      {
        "db": "BID",
        "id": "74643"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-2282",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2015-2282",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-2282",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-2282",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201505-483",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2015-2282",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. plural SAP Product LZC Implementation of decompression (vpa106cslzc.cpp of CsObjectInt::CsDecomprLZC function ) Contains a stack-based buffer overflow vulnerability. Vendors have confirmed this vulnerability SAP Security Note 2124806 , 2121661 , 2127995 ,and 2125316 It is released as.Denial of service by attacker ( crash ) Could be put into a state or execute arbitrary code. Multiple SAP Products are prone to a buffer-overflow vulnerability and a denial-of-service vulnerability. \nRemote attackers can exploit these issues to  execute arbitrary code  in the context of the application or cause  denial-of-service  conditions. 1. Advisory Information\n\nTitle: SAP LZC/LZH Compression Multiple Vulnerabilities\nAdvisory ID: CORE-2015-0009\nAdvisory URL: http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities\nDate published: 2015-05-12\nDate of last update: 2015-05-12\nVendors contacted: SAP\nRelease mode: Coordinated release\n\n2. Vulnerability Information\n\nClass: Out-of-bounds Write [CWE-787], Out-of-bounds Read [CWE-125]\nImpact: Denial of service\nRemotely Exploitable: Yes\nLocally Exploitable: Yes\nCVE Name: CVE-2015-2282, CVE-2015-2278\n\n\n3. Vulnerability Description\n\nSAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the decompression routines that could be triggered in different scenarios, and could lead to execution of arbitrary code and denial of service conditions. \n\n\n4. Vulnerable Packages\n\nSAP Netweaver Application Server ABAP. \nSAP Netweaver Application Server Java. \nSAP Netweaver RFC SDK\nSAP RFC SDK\nSAP GUI\nSAP MaxDB database\nSAPCAR archive tool\nOther products and versions might be affected, but they were not tested. \n\n\n5. Vendor Information, Solutions and Workarounds\n\nSAP published the following Security Notes:\n\n2124806\n2121661\n2127995\n2125316\nThey can be accessed by SAP clients in their Support Portal [15]. \n\nDevelopers who used the Open Source versions of MaxDB 7.5 and 7.6 for their tools should contact SAP. \n\n\n6. Credits\n\nThis vulnerability was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Joaqu\u00edn Rodr\u00edguez Varela from Core Advisories Team. \n\n\n\n7. Technical Description / Proof of Concept Code\n\nSAP products make use of LZC and LZH algorithms for compressing in-transit data for different services (Diag protocol, RFC protocol, MaxDB protocol) and for distributing files (SAPCAR program). The implementation of this algorithm was also included in Open Source versions of MaxDB 7.5 and 7.6 [2], and used on multiple Open Source security-related programs [3][4][5][6][7][8][9][10][11]. \n\nThe code that handles the decompression of LZC and LZH compressed data is prone to two memory corruption vulnerabilities, as described below. \n\n7.1. \n\nThe following snippet of code shows the vulnerable function [file vpa106cslzc.cpp in the MaxDB source code [12]]. This piece of code can be reached by decompressing a specially crafted buffer. \n\n \n[..]\nint CsObjectInt::CsDecomprLZC (SAP_BYTE * inbuf,\n                  SAP_INT    inlen,\n                  SAP_BYTE * outbuf,\n                  SAP_INT    outlen,\n                  SAP_INT    option,\n                  SAP_INT *  bytes_read,\n                  SAP_INT *  bytes_written)\n    [..]\n    /* Generate output characters in reverse order ...................*/\n    while (code \u003e= 256)\n    {\n      *stackp++ = TAB_SUFFIXOF(code);\n      OVERFLOW_CHECK\n      code = TAB_PREFIXOF(code);\n    }\n[..]\nNote that the \"code\" variable contains an attacker controlled value, resulting in a stack overflow if the value is greater than 256 and the value for that code in the prefix table is also greater than 256. It\u0027s possible to fill in the stack with arbitrary values by controlling the values stored in the prefix and suffix tables. \n\nIt\u0027s also worth mentioning that the above code includes a macro for performing some bounds checks on the stack pointer (\"OVERFLOW_CHECK\"). However, the check implemented by this macro is not sufficient for avoiding this vulnerability and also could lead to fault conditions when decompressing valid buffers. Moreover, vulnerable products and programs were built without this macro enabled (\"CS_STACK_CHECK\" macro not defined at the time of compilation). \n\n7.2. LZH decompression out-of-bounds read\n\nThe vulnerability [CVE-2015-2278] is caused by an out-of-bounds read of a buffer used by the decompression routine when performing look-ups of non-simple codes. \n\nThe following piece of code shows the vulnerable function [file vpa108csulzh.cpp in the MaxDB source code [13]]. This piece of code can be reached by decompressing a specially crafted buffer. \n\n \n[..]\nint CsObjectInt::BuildHufTree (\n             unsigned * b,  /* code lengths in bits (all assumed \u003c= BMAX) */\n             unsigned   n,  /* number of codes (assumed \u003c= N_MAX) */\n             unsigned   s,  /* number of simple-valued codes (0..s-1) */\n             int      * d,  /* list of base values for non-simple codes */\n             int      * e,  /* list of extra bits for non-simple codes */\n             HUFTREE  **t,  /* result: starting table */\n             int      * m)  /* maximum lookup bits, returns actual */\n    [..]\n      if (p \u003e= v + n)\n      {\n        r.e = INVALIDCODE;             /* out of values--invalid code */\n      }\n      else if (*p \u003c s)\n      {                         /* 256 is end-of-block code */\n        r.e = (unsigned char)(*p \u003c 256 ? LITCODE : EOBCODE);\n        r.v.n = (unsigned short) *p;  /* simple code is just the value*/\n        p++;\n      }\n      else\n      {\n        r.e = (unsigned char) e[*p - s]; /*non-simple,look up in lists*/\n        r.v.n = (unsigned short) d[*p - s];\n        p++;\n      }\n[..]\n \nThe \"e\" and \"d\" arrays are indexed with the value of \"*p - s\" which is an attacker-controlled value. When the code is reached, this results in an out-of-bounds read access. \n\n7.3. Attack scenarios\n\nThe vulnerabilities affect a varied range of products and programs. The attack scenarios differ based on the way each product makes use of the compression libraries. At very least the following scenarios can be identified:\n\n7.3.1. Attacks against server-side components\n\nSAP Netweaver services like Dispatcher or Gateway handle compressed requests coming from the different clients connecting to them. A remote unauthenticated attacker might be able to connect to the aforementioned services and trigger the vulnerabilities by sending specially crafted packets. \n\n7.3.2. Client-side attacks\n\nAn attacker might be able to perform client-side attacks against users of the affected programs that handle compressed data. For instance, an attacker might send a specially crafted .CAR or .SAR archive file aimed at being decompressed using the SAPCAR tool, or mount a rogue SAP server offering Dispatcher and entice users to connect to this malicious server using SAP GUI. \n\n7.3.3. Man-in-the-middle attacks\n\nAs most of the services affected by these issues are not encrypted by default, an attacker might be able to perform a man-in-the-middle attack and trigger the vulnerabilities by injecting malicious packets within the communication. \n\n7.4. Looking in binaries for compression routines\n\nThe LZC and LZH compression algorithm routines are statically compiled in the different binaries of the affected products and programs. It\u0027s possible to check if a binary includes these functions by looking at whether the algorithm\u0027s constants are used in the program. \n\nThe following Radare [14] command can be used to check if a binary file includes the mentioned constants:\n\n \n$ rafind2 -x fffefcf8f0e0c080 -x 0103070f1f3f7fff \u003cbinary_file\u003e\n         \nExample output:\n\n \n$ rafind2 -X -x fffefcf8f0e0c080 -x 0103070f1f3f7fff SAPCAR64 \n\nSAPCAR64: 000 @ 0x1082c1\n   offset    0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\n0x001082c1  0103 070f 1f3f 7fff fffe fcf8 f0e0 c080  .....?.......... \n0x001082d1  0000 0000 0000 0000 0000 0000 0000 0000  ................ \n0x001082e1  0000 0000 0000 0000 0000 0000 0000 0004  ................ \n0x001082f1  0000 0004 0000 0010 0000 0000 0000 0006  ................ \n0x00108301  0000 0008 0000 0010 0000 0000 0000       ..............  \n \n\n\n8. Report Timeline\n\n2015-01-20: Core Security sends an initial notification to SAP. Publication date set to Mar 10, 2015 (Patch Tuesday). \n2015-01-21: SAP confirms reception and requests a draft version of the advisory. \n2015-01-21: Core Security sends the draft version of the advisory to the vendor. \n2015-01-21: SAP confirms reception of the report and assigns the following security message Number: 55318 2015. \n2015-01-22: SAP asks if the two vulnerable functions mentioned in the draft are the only ones affected by these vulnerabilities. \n2015-01-22: Core Security informs the vendor that researchers were only able to trigger the vulnerabilities in the functions mentioned in the draft advisory. In case they find other instances where the vulnerabilities can be triggered, Core requests to be informed. \n2015-01-30: Core Security asks the vendor if they were able to verify the vulnerabilities in order to coordinate a proper release date. \n2015-02-02: SAP states that they verified and confirmed the vulnerabilities, are working on a solution, and will provide an update once the solution plan is finished. \n2015-02-04: SAP states that they will be able to provide a fix by May\u0027s Patch Tuesday, 2015, and not March as requested. They also request to know how the advisory is going to be published and if we have any plans to include them in any upcoming presentations. \n2015-02-10: SAP requests confirmation of their previous email in order to coordinate the advisory for the May 12th, 2015. \n2015-02-18: Core Security informs SAP that the date is confirmed and that researchers might present something after the publication of the advisory. \n2015-02-19: SAP states that it is thankful for Core\u0027s commitment to go for a coordinated release. They say they will keep us updated. \n2015-05-07: Core Security reminds SAP that the date for the proposed fix to be released is the following week, therefore we would like to resume communications in order to publish our findings in a coordinated manner. \n2015-05-07: SAP informs that they are on track to release the security notes as part of their May patch day (May 12th, 2015). \n2015-05-11: Core Security asks SAP for the specific time they are planning to publish their security note and requests a tentative link so it can be included in Core\u0027s advisory. Additionally, Core sends a tentative fix for the source code that it is planning to add in its advisory for SAP to review, and a list of vulnerable tools that used the vulnerable code so SAP can contact and inform the owners of the fix. \n2015-05-12: SAP states that they published 4 security notes regarding the issues we reported. They requested for us to wait 3 months to publish our findings and to send them the advisory before is published. \n2015-05-12: Core Security requests that SAP fixes the external ID (Core\u0027s ID) they used and offer Core\u0027s publication link. Additionally, Core explained that is their policy to release their findings the same day the vendor does. Core also reminded SAP that they were still waiting for a reply to their previous email. \n2015-05-12: Advisory CORE-2015-0009 published. \n\n\n9. References\n\n[1] http://en.wikipedia.org/wiki/LZ77_and_LZ78. \n[2] ftp://ftp.sap.com/pub/maxdb/current/7.6.00/. \n[3] http://conus.info/utils/SAP_pkt_decompr.txt. \n[4] https://github.com/sensepost/SAPProx. \n[5] https://github.com/sensepost/SapCap. \n[6] http://blog.ptsecurity.com/2011/10/sap-diag-decompress-plugin-for.html. \n[7] https://github.com/CoreSecurity/pysap. \n[8] https://github.com/CoreSecurity/SAP-Dissection-plug-in-for-Wireshark. \n[9] https://github.com/daberlin/sap-reposrc-decompressor. \n[10] https://labs.mwrinfosecurity.com/tools/sap-decom/. \n[11] http://www.oxid.it/cain.html. \n[12] http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa106cslzc_8cpp-source.html. \n[13] http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa108csulzh_8cpp-source.html. \n[14] http://radare.org/y/. \n[15] https://service.sap.com/securitynotes. \n\n\n10. About CoreLabs\n\nCoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. \n\n\n11. About Core Security\n\nCore Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted research and leading-edge threat expertise from the company\u0027s Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. \n\n\n12. Disclaimer\n\nThe contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n13. PGP/GPG Keys\n\nThis advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-2282",
        "trust": 2.9
      },
      {
        "db": "PACKETSTORM",
        "id": "131883",
        "trust": 1.8
      },
      {
        "db": "BID",
        "id": "74643",
        "trust": 1.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923",
        "trust": 0.8
      },
      {
        "db": "SECUNIA",
        "id": "64440",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-2282",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "id": "VAR-201506-0132",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.167840075
  },
  "last_update_date": "2025-04-13T23:29:37.503000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Note 2124806/2121661/2127995/2125316",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/DOC-55451"
      },
      {
        "title": "martingalloar",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/martingalloar "
      },
      {
        "title": "publications",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/publications "
      },
      {
        "title": "The Register",
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2015/05/14/saps_compression_is_buggy_and_insecure/"
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/remotely-exploitable-vulnerabilities-in-sap-compression-algorithms/112808/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities"
      },
      {
        "trust": 1.7,
        "url": "http://packetstormsecurity.com/files/131883/sap-lzc-lzh-compression-denial-of-service.html"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2015/may/50"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2015/may/96"
      },
      {
        "trust": 1.2,
        "url": "http://www.securityfocus.com/bid/74643"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/535535/100/0/threaded"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2282"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2282"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/535535/100/0/threaded"
      },
      {
        "trust": 0.6,
        "url": "http://secunia.com/advisories/64440"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://threatpost.com/remotely-exploitable-vulnerabilities-in-sap-compression-algorithms/112808/"
      },
      {
        "trust": 0.1,
        "url": "http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa108csulzh_8cpp-source.html."
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/sensepost/sapcap."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/coresecurity/sap-dissection-plug-in-for-wireshark."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/sensepost/sapprox."
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
      },
      {
        "trust": 0.1,
        "url": "http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa106cslzc_8cpp-source.html."
      },
      {
        "trust": 0.1,
        "url": "https://service.sap.com/securitynotes."
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/coresecurity/pysap."
      },
      {
        "trust": 0.1,
        "url": "http://conus.info/utils/sap_pkt_decompr.txt."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2282"
      },
      {
        "trust": 0.1,
        "url": "http://www.oxid.it/cain.html."
      },
      {
        "trust": 0.1,
        "url": "https://labs.mwrinfosecurity.com/tools/sap-decom/."
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/daberlin/sap-reposrc-decompressor."
      },
      {
        "trust": 0.1,
        "url": "http://blog.ptsecurity.com/2011/10/sap-diag-decompress-plugin-for.html."
      },
      {
        "trust": 0.1,
        "url": "http://radare.org/y/."
      },
      {
        "trust": 0.1,
        "url": "http://en.wikipedia.org/wiki/lz77_and_lz78."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2278"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-06-02T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "date": "2015-05-13T00:00:00",
        "db": "BID",
        "id": "74643"
      },
      {
        "date": "2015-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "date": "2015-05-13T17:48:36",
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "date": "2015-05-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "date": "2015-06-02T14:59:08.880000",
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-2282"
      },
      {
        "date": "2015-05-13T00:00:00",
        "db": "BID",
        "id": "74643"
      },
      {
        "date": "2015-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      },
      {
        "date": "2015-06-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2015-2282"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  SAP Product  LZC Stack-based buffer overflow vulnerability in the decompression implementation",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002923"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-483"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201506-0131",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "maxdb",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "sap",
        "version": "7.5"
      },
      {
        "model": "maxdb",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "sap",
        "version": "7.6"
      },
      {
        "model": "netweaver rfc sdk",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver abap application server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "gui",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver java application server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "rfc library",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "*"
      },
      {
        "model": "gui",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver application server abap",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver application server java",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver rfc sdk",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "\\u3000"
      },
      {
        "model": "rfc library",
        "scope": null,
        "trust": 0.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "sapcar archive tool",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "rfc sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver rfc sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver application server abap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "maxdb database",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "gui",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:gui",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:maxdb",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_abap_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_java_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_rfc_sdk",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Martin Gallo of Core Security Consulting Services.",
    "sources": [
      {
        "db": "BID",
        "id": "74643"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-2278",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2015-2278",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-2278",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-2278",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201505-482",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2015-2278",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. Vendors have confirmed this vulnerability SAP Security Note 2124806 , 2121661 , 2127995 ,and 2125316 It is released as.Denial of service by attacker (out-of-bounds read) There is a possibility of being put into a state. Multiple SAP Products are prone to a buffer-overflow vulnerability and a denial-of-service vulnerability. \nRemote attackers can exploit these issues to  execute arbitrary code  in the context of the application or cause  denial-of-service  conditions. 1. Advisory Information\n\nTitle: SAP LZC/LZH Compression Multiple Vulnerabilities\nAdvisory ID: CORE-2015-0009\nAdvisory URL: http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities\nDate published: 2015-05-12\nDate of last update: 2015-05-12\nVendors contacted: SAP\nRelease mode: Coordinated release\n\n2. Vulnerability Information\n\nClass: Out-of-bounds Write [CWE-787], Out-of-bounds Read [CWE-125]\nImpact: Denial of service\nRemotely Exploitable: Yes\nLocally Exploitable: Yes\nCVE Name: CVE-2015-2282, CVE-2015-2278\n\n\n3. Vulnerability Description\n\nSAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the decompression routines that could be triggered in different scenarios, and could lead to execution of arbitrary code and denial of service conditions. \n\n\n4. Vulnerable Packages\n\nSAP Netweaver Application Server ABAP. \nSAP Netweaver Application Server Java. \nSAP Netweaver RFC SDK\nSAP RFC SDK\nSAP GUI\nSAP MaxDB database\nSAPCAR archive tool\nOther products and versions might be affected, but they were not tested. \n\n\n5. Vendor Information, Solutions and Workarounds\n\nSAP published the following Security Notes:\n\n2124806\n2121661\n2127995\n2125316\nThey can be accessed by SAP clients in their Support Portal [15]. \n\nDevelopers who used the Open Source versions of MaxDB 7.5 and 7.6 for their tools should contact SAP. \n\n\n6. Credits\n\nThis vulnerability was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Joaqu\u00edn Rodr\u00edguez Varela from Core Advisories Team. \n\n\n\n7. Technical Description / Proof of Concept Code\n\nSAP products make use of LZC and LZH algorithms for compressing in-transit data for different services (Diag protocol, RFC protocol, MaxDB protocol) and for distributing files (SAPCAR program). The implementation of this algorithm was also included in Open Source versions of MaxDB 7.5 and 7.6 [2], and used on multiple Open Source security-related programs [3][4][5][6][7][8][9][10][11]. \n\nThe code that handles the decompression of LZC and LZH compressed data is prone to two memory corruption vulnerabilities, as described below. \n\n7.1. LZC decompression stack-based buffer overflow\n\nThe vulnerability [CVE-2015-2282] is caused by an out-of-bounds write to a stack buffer used by the decompression routine to write the output characters. \n\nThe following snippet of code shows the vulnerable function [file vpa106cslzc.cpp in the MaxDB source code [12]]. This piece of code can be reached by decompressing a specially crafted buffer. \n\n \n[..]\nint CsObjectInt::CsDecomprLZC (SAP_BYTE * inbuf,\n                  SAP_INT    inlen,\n                  SAP_BYTE * outbuf,\n                  SAP_INT    outlen,\n                  SAP_INT    option,\n                  SAP_INT *  bytes_read,\n                  SAP_INT *  bytes_written)\n    [..]\n    /* Generate output characters in reverse order ...................*/\n    while (code \u003e= 256)\n    {\n      *stackp++ = TAB_SUFFIXOF(code);\n      OVERFLOW_CHECK\n      code = TAB_PREFIXOF(code);\n    }\n[..]\nNote that the \"code\" variable contains an attacker controlled value, resulting in a stack overflow if the value is greater than 256 and the value for that code in the prefix table is also greater than 256. It\u0027s possible to fill in the stack with arbitrary values by controlling the values stored in the prefix and suffix tables. \n\nIt\u0027s also worth mentioning that the above code includes a macro for performing some bounds checks on the stack pointer (\"OVERFLOW_CHECK\"). However, the check implemented by this macro is not sufficient for avoiding this vulnerability and also could lead to fault conditions when decompressing valid buffers. Moreover, vulnerable products and programs were built without this macro enabled (\"CS_STACK_CHECK\" macro not defined at the time of compilation). \n\n7.2. LZH decompression out-of-bounds read\n\nThe vulnerability [CVE-2015-2278] is caused by an out-of-bounds read of a buffer used by the decompression routine when performing look-ups of non-simple codes. \n\nThe following piece of code shows the vulnerable function [file vpa108csulzh.cpp in the MaxDB source code [13]]. This piece of code can be reached by decompressing a specially crafted buffer. \n\n \n[..]\nint CsObjectInt::BuildHufTree (\n             unsigned * b,  /* code lengths in bits (all assumed \u003c= BMAX) */\n             unsigned   n,  /* number of codes (assumed \u003c= N_MAX) */\n             unsigned   s,  /* number of simple-valued codes (0..s-1) */\n             int      * d,  /* list of base values for non-simple codes */\n             int      * e,  /* list of extra bits for non-simple codes */\n             HUFTREE  **t,  /* result: starting table */\n             int      * m)  /* maximum lookup bits, returns actual */\n    [..]\n      if (p \u003e= v + n)\n      {\n        r.e = INVALIDCODE;             /* out of values--invalid code */\n      }\n      else if (*p \u003c s)\n      {                         /* 256 is end-of-block code */\n        r.e = (unsigned char)(*p \u003c 256 ? LITCODE : EOBCODE);\n        r.v.n = (unsigned short) *p;  /* simple code is just the value*/\n        p++;\n      }\n      else\n      {\n        r.e = (unsigned char) e[*p - s]; /*non-simple,look up in lists*/\n        r.v.n = (unsigned short) d[*p - s];\n        p++;\n      }\n[..]\n \nThe \"e\" and \"d\" arrays are indexed with the value of \"*p - s\" which is an attacker-controlled value. When the code is reached, this results in an out-of-bounds read access. \n\n7.3. Attack scenarios\n\nThe vulnerabilities affect a varied range of products and programs. The attack scenarios differ based on the way each product makes use of the compression libraries. At very least the following scenarios can be identified:\n\n7.3.1. Attacks against server-side components\n\nSAP Netweaver services like Dispatcher or Gateway handle compressed requests coming from the different clients connecting to them. A remote unauthenticated attacker might be able to connect to the aforementioned services and trigger the vulnerabilities by sending specially crafted packets. \n\n7.3.2. Client-side attacks\n\nAn attacker might be able to perform client-side attacks against users of the affected programs that handle compressed data. For instance, an attacker might send a specially crafted .CAR or .SAR archive file aimed at being decompressed using the SAPCAR tool, or mount a rogue SAP server offering Dispatcher and entice users to connect to this malicious server using SAP GUI. \n\n7.3.3. Man-in-the-middle attacks\n\nAs most of the services affected by these issues are not encrypted by default, an attacker might be able to perform a man-in-the-middle attack and trigger the vulnerabilities by injecting malicious packets within the communication. \n\n7.4. Looking in binaries for compression routines\n\nThe LZC and LZH compression algorithm routines are statically compiled in the different binaries of the affected products and programs. It\u0027s possible to check if a binary includes these functions by looking at whether the algorithm\u0027s constants are used in the program. \n\nThe following Radare [14] command can be used to check if a binary file includes the mentioned constants:\n\n \n$ rafind2 -x fffefcf8f0e0c080 -x 0103070f1f3f7fff \u003cbinary_file\u003e\n         \nExample output:\n\n \n$ rafind2 -X -x fffefcf8f0e0c080 -x 0103070f1f3f7fff SAPCAR64 \n\nSAPCAR64: 000 @ 0x1082c1\n   offset    0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\n0x001082c1  0103 070f 1f3f 7fff fffe fcf8 f0e0 c080  .....?.......... \n0x001082d1  0000 0000 0000 0000 0000 0000 0000 0000  ................ \n0x001082e1  0000 0000 0000 0000 0000 0000 0000 0004  ................ \n0x001082f1  0000 0004 0000 0010 0000 0000 0000 0006  ................ \n0x00108301  0000 0008 0000 0010 0000 0000 0000       ..............  \n \n\n\n8. Report Timeline\n\n2015-01-20: Core Security sends an initial notification to SAP. Publication date set to Mar 10, 2015 (Patch Tuesday). \n2015-01-21: SAP confirms reception and requests a draft version of the advisory. \n2015-01-21: Core Security sends the draft version of the advisory to the vendor. \n2015-01-21: SAP confirms reception of the report and assigns the following security message Number: 55318 2015. \n2015-01-22: SAP asks if the two vulnerable functions mentioned in the draft are the only ones affected by these vulnerabilities. \n2015-01-22: Core Security informs the vendor that researchers were only able to trigger the vulnerabilities in the functions mentioned in the draft advisory. In case they find other instances where the vulnerabilities can be triggered, Core requests to be informed. \n2015-01-30: Core Security asks the vendor if they were able to verify the vulnerabilities in order to coordinate a proper release date. \n2015-02-02: SAP states that they verified and confirmed the vulnerabilities, are working on a solution, and will provide an update once the solution plan is finished. \n2015-02-04: SAP states that they will be able to provide a fix by May\u0027s Patch Tuesday, 2015, and not March as requested. They also request to know how the advisory is going to be published and if we have any plans to include them in any upcoming presentations. \n2015-02-10: SAP requests confirmation of their previous email in order to coordinate the advisory for the May 12th, 2015. \n2015-02-18: Core Security informs SAP that the date is confirmed and that researchers might present something after the publication of the advisory. \n2015-02-19: SAP states that it is thankful for Core\u0027s commitment to go for a coordinated release. They say they will keep us updated. \n2015-05-07: Core Security reminds SAP that the date for the proposed fix to be released is the following week, therefore we would like to resume communications in order to publish our findings in a coordinated manner. \n2015-05-07: SAP informs that they are on track to release the security notes as part of their May patch day (May 12th, 2015). \n2015-05-11: Core Security asks SAP for the specific time they are planning to publish their security note and requests a tentative link so it can be included in Core\u0027s advisory. Additionally, Core sends a tentative fix for the source code that it is planning to add in its advisory for SAP to review, and a list of vulnerable tools that used the vulnerable code so SAP can contact and inform the owners of the fix. \n2015-05-12: SAP states that they published 4 security notes regarding the issues we reported. They requested for us to wait 3 months to publish our findings and to send them the advisory before is published. \n2015-05-12: Core Security requests that SAP fixes the external ID (Core\u0027s ID) they used and offer Core\u0027s publication link. Additionally, Core explained that is their policy to release their findings the same day the vendor does. Core also reminded SAP that they were still waiting for a reply to their previous email. \n2015-05-12: Advisory CORE-2015-0009 published. \n\n\n9. References\n\n[1] http://en.wikipedia.org/wiki/LZ77_and_LZ78. \n[2] ftp://ftp.sap.com/pub/maxdb/current/7.6.00/. \n[3] http://conus.info/utils/SAP_pkt_decompr.txt. \n[4] https://github.com/sensepost/SAPProx. \n[5] https://github.com/sensepost/SapCap. \n[6] http://blog.ptsecurity.com/2011/10/sap-diag-decompress-plugin-for.html. \n[7] https://github.com/CoreSecurity/pysap. \n[8] https://github.com/CoreSecurity/SAP-Dissection-plug-in-for-Wireshark. \n[9] https://github.com/daberlin/sap-reposrc-decompressor. \n[10] https://labs.mwrinfosecurity.com/tools/sap-decom/. \n[11] http://www.oxid.it/cain.html. \n[12] http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa106cslzc_8cpp-source.html. \n[13] http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa108csulzh_8cpp-source.html. \n[14] http://radare.org/y/. \n[15] https://service.sap.com/securitynotes. \n\n\n10. About CoreLabs\n\nCoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. \n\n\n11. About Core Security\n\nCore Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted research and leading-edge threat expertise from the company\u0027s Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. \n\n\n12. Disclaimer\n\nThe contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n13. PGP/GPG Keys\n\nThis advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-2278",
        "trust": 2.9
      },
      {
        "db": "PACKETSTORM",
        "id": "131883",
        "trust": 1.8
      },
      {
        "db": "BID",
        "id": "74643",
        "trust": 1.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925",
        "trust": 0.8
      },
      {
        "db": "SECUNIA",
        "id": "64440",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-2278",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "id": "VAR-201506-0131",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.167840075
  },
  "last_update_date": "2025-04-13T23:29:37.469000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Note 2124806/2121661/2127995/2125316",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/DOC-55451"
      },
      {
        "title": "martingalloar",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/martingalloar "
      },
      {
        "title": "publications",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/publications "
      },
      {
        "title": "The Register",
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2015/05/14/saps_compression_is_buggy_and_insecure/"
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/remotely-exploitable-vulnerabilities-in-sap-compression-algorithms/112808/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities"
      },
      {
        "trust": 1.7,
        "url": "http://packetstormsecurity.com/files/131883/sap-lzc-lzh-compression-denial-of-service.html"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2015/may/50"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2015/may/96"
      },
      {
        "trust": 1.2,
        "url": "http://www.securityfocus.com/bid/74643"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/535535/100/0/threaded"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2278"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2278"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/535535/100/0/threaded"
      },
      {
        "trust": 0.6,
        "url": "http://secunia.com/advisories/64440"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://threatpost.com/remotely-exploitable-vulnerabilities-in-sap-compression-algorithms/112808/"
      },
      {
        "trust": 0.1,
        "url": "http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa108csulzh_8cpp-source.html."
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/sensepost/sapcap."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/coresecurity/sap-dissection-plug-in-for-wireshark."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/sensepost/sapprox."
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
      },
      {
        "trust": 0.1,
        "url": "http://maxdb-7.5.00.sourcearchive.com/documentation/7.5.00.44-2/vpa106cslzc_8cpp-source.html."
      },
      {
        "trust": 0.1,
        "url": "https://service.sap.com/securitynotes."
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/coresecurity/pysap."
      },
      {
        "trust": 0.1,
        "url": "http://conus.info/utils/sap_pkt_decompr.txt."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2282"
      },
      {
        "trust": 0.1,
        "url": "http://www.oxid.it/cain.html."
      },
      {
        "trust": 0.1,
        "url": "https://labs.mwrinfosecurity.com/tools/sap-decom/."
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://github.com/daberlin/sap-reposrc-decompressor."
      },
      {
        "trust": 0.1,
        "url": "http://blog.ptsecurity.com/2011/10/sap-diag-decompress-plugin-for.html."
      },
      {
        "trust": 0.1,
        "url": "http://radare.org/y/."
      },
      {
        "trust": 0.1,
        "url": "http://en.wikipedia.org/wiki/lz77_and_lz78."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2278"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "db": "BID",
        "id": "74643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-06-02T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "date": "2015-05-13T00:00:00",
        "db": "BID",
        "id": "74643"
      },
      {
        "date": "2015-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "date": "2015-05-13T17:48:36",
        "db": "PACKETSTORM",
        "id": "131883"
      },
      {
        "date": "2015-05-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "date": "2015-06-02T14:59:07.537000",
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-2278"
      },
      {
        "date": "2015-05-13T00:00:00",
        "db": "BID",
        "id": "74643"
      },
      {
        "date": "2015-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      },
      {
        "date": "2015-06-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2015-2278"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  SAP Product  LZH Service disruption in decompression implementation  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-002925"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201505-482"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201604-0101",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.1 to  7.5"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vahagn Vardanyan (ERPScan).",
    "sources": [
      {
        "db": "BID",
        "id": "85943"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-3973",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-3973",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-3973",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2016-3973",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-3973",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-3973",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201604-094",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Chat#, pressing \"Add users\", and doing a search, aka SAP Security Note 2255990. SAP NetWeaver is prone to an information-disclosure vulnerability. \nAttackers can exploit this issue to obtain sensitive information that may lead to further attacks. \nSAP Netweaver 7.4 is vulnerable; other versions may also be affected",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "BID",
        "id": "85943"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-3973",
        "trust": 2.7
      },
      {
        "db": "PACKETSTORM",
        "id": "137579",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "85943",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "85943"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "id": "VAR-201604-0101",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-13T23:22:21.769000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Note 2255990",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/DOC-55451"
      },
      {
        "title": "SAP NetWeaver AS Java Real-Time Collaboration Repair measures for service security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60825"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-16-016-sap-netweaver-7-4-information-disclosure-wd_chat/"
      },
      {
        "trust": 1.6,
        "url": "http://seclists.org/fulldisclosure/2016/jun/46"
      },
      {
        "trust": 1.6,
        "url": "http://packetstormsecurity.com/files/137579/sap-netweaver-as-java-7.5-information-disclosure.html"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3973"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3973"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-16-016-sap-netweaver-7-4-information-disclosure-wd_chat/"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "85943"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "85943"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-09T00:00:00",
        "db": "BID",
        "id": "85943"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "date": "2016-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "date": "2016-04-07T19:59:04.377000",
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-09T00:00:00",
        "db": "BID",
        "id": "85943"
      },
      {
        "date": "2016-08-31T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2016-3973"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver Java AS Vulnerability in the acquisition of important user information in the chat function of the real-time collaboration service",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002000"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-094"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201604-0102",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.4"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vahagn Vardanyan from ERPScan.",
    "sources": [
      {
        "db": "BID",
        "id": "85944"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-3974",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-3974",
            "impactScore": 4.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2016-3974",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-3974",
            "impactScore": 5.2,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2016-3974",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-3974",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-3974",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201604-095",
            "trust": 0.6,
            "value": "CRITICAL"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994. Vendors have confirmed this vulnerability SAP Security Note 2235994 It is released as. Supplementary information : CWE Vulnerability type by CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) (XML Inappropriate restrictions on external entity references ) Has been identified. \nAttackers can exploit this issue to obtain potentially sensitive  information or cause a denial-of-service condition. This may lead to  further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "BID",
        "id": "85944"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-3974",
        "trust": 2.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39995",
        "trust": 1.6
      },
      {
        "db": "PACKETSTORM",
        "id": "137527",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "85944",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "85944"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "id": "VAR-201604-0102",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-04-13T23:21:07.986000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Note 2235994",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/DOC-55451"
      },
      {
        "title": "SAP NetWeaver AS Java Configuration Wizard XML Fixes for external entity vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60826"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "http://packetstormsecurity.com/files/137527/sap-netweaver-as-java-7.5-xxe-injection.html"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-16-013-sap-netweaver-7-4-ctcprotocol-servlet-xxe/"
      },
      {
        "trust": 1.6,
        "url": "https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/"
      },
      {
        "trust": 1.6,
        "url": "https://www.exploit-db.com/exploits/39995/"
      },
      {
        "trust": 1.6,
        "url": "http://seclists.org/fulldisclosure/2016/jun/41"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3974"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3974"
      },
      {
        "trust": 0.8,
        "url": "https://erpscan.com/advisories/erpscan-16-013-sap-netweaver-7-4-ctcprotocol-servlet-xxe/"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "85944"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "85944"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-08T00:00:00",
        "db": "BID",
        "id": "85944"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "date": "2016-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "date": "2016-04-07T19:59:05.240000",
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-08T00:00:00",
        "db": "BID",
        "id": "85944"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2016-3974"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver Java AS of  Configuration Wizard In  XML External entity vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-002001"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-095"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201604-0202",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.4"
      },
      {
        "model": "netweaver as java",
        "scope": null,
        "trust": 0.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "netweaver",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Alexander Polyakov of ERPScan",
    "sources": [
      {
        "db": "BID",
        "id": "77117"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2015-8840",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2015-8840",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2015-07260",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2015-8840",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "Low",
            "baseScore": 6.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2015-8840",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-8840",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-8840",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2015-07260",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201604-100",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215. SAP NetWeaver is a set of service-oriented integrated application platform from SAP (Germany), which provides a development and operating environment for SAP applications. SAP NetWeaver AS (Application Server) Java is an application server running on NetWeaver and based on the Java programming language. \nAn unauthorized access vulnerability exists in SAP NetWeaver AS Java. An attacker could use this vulnerability to obtain sensitive information",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "db": "BID",
        "id": "77117"
      },
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      }
    ],
    "trust": 3.15
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-8840",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "77117",
        "trust": 1.5
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715",
        "trust": 0.6
      },
      {
        "db": "IVD",
        "id": "4B143DC0-1E5B-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "BID",
        "id": "77117"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "id": "VAR-201604-0202",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      }
    ],
    "trust": 1.07111164
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      }
    ]
  },
  "last_update_date": "2025-04-12T23:28:43.982000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Notes July 2015 (1945215)",
        "trust": 0.8,
        "url": "http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015"
      },
      {
        "title": "SAP NetWeaver AS JAVA Unauthorized Access Vulnerability Patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/66158"
      },
      {
        "title": "SAP NetWeaver AS Java XML Data Archiving Service Repair measures for service security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60831"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-862",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-264",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://erpscan.io/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauthorized-access/"
      },
      {
        "trust": 1.6,
        "url": "http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015"
      },
      {
        "trust": 1.2,
        "url": "http://www.securityfocus.com/bid/77117"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8840"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8840"
      },
      {
        "trust": 0.8,
        "url": "http://erpscan.com/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauthorized-access/"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "BID",
        "id": "77117"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "BID",
        "id": "77117"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-11-05T00:00:00",
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2015-11-05T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "date": "2015-10-13T00:00:00",
        "db": "BID",
        "id": "77117"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "date": "2015-10-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "date": "2016-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "date": "2016-04-08T00:59:00.120000",
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-11-05T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "date": "2016-07-06T14:23:00",
        "db": "BID",
        "id": "77117"
      },
      {
        "date": "2016-04-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-007026"
      },
      {
        "date": "2015-10-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2015-8840"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      }
    ],
    "trust": 1.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS JAVA Unauthorized Access Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "4b143dc0-1e5b-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07260"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201510-715"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control issues",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201604-100"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201802-0846",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver java web application",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "web application 7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.50"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103005"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver_java_application_server",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "103005"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-2371",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-2371",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-2371",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.8,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-2371",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-2371",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201802-944",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability. \nRemote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the  context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "BID",
        "id": "103005"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-2371",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "103005",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103005"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "id": "VAR-201802-0846",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2024-11-23T23:05:14.474000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "February 2018 (2560741)",
        "trust": 0.8,
        "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "http://www.securityfocus.com/bid/103005"
      },
      {
        "trust": 1.9,
        "url": "https://launchpad.support.sap.com/#/notes/2560741"
      },
      {
        "trust": 1.9,
        "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-2371"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2371"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103005"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "103005"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-02-13T00:00:00",
        "db": "BID",
        "id": "103005"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "date": "2018-02-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "date": "2018-02-14T12:29:00.390000",
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-02-13T00:00:00",
        "db": "BID",
        "id": "103005"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      },
      {
        "date": "2018-04-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      },
      {
        "date": "2024-11-21T04:03:41.850000",
        "db": "NVD",
        "id": "CVE-2018-2371"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP Netweaver AS Java Web Application Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002273"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-944"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201812-0571",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.20"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106153"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP",
    "sources": [
      {
        "db": "BID",
        "id": "106153"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-2492",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2018-2492",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-2492",
            "impactScore": 4.2,
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.1,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-2492",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-2492",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-2492",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201812-485",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50. SAP NetWeaver AS Java Contains an input validation vulnerability.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. SAP NetWeaver AS Java is prone to an XML External Entity injection vulnerability. \nAttackers can exploit this issue to gain access to sensitive information or cause denial-of-service conditions",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "BID",
        "id": "106153"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-2492",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "106153",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106153"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "id": "VAR-201812-0571",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2024-11-23T23:04:55.644000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Patch Day - December 2018",
        "trust": 0.8,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
      },
      {
        "title": "SAP NetWeaver AS Java Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87733"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-20",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=508559699"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/106153"
      },
      {
        "trust": 1.6,
        "url": "https://launchpad.support.sap.com/#/notes/2642680"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-2492"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2492"
      },
      {
        "trust": 0.3,
        "url": "https://wiki.scn.sap.com/wiki/display/asjava/as+java+home"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106153"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "106153"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-11T00:00:00",
        "db": "BID",
        "id": "106153"
      },
      {
        "date": "2019-02-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "date": "2018-12-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "date": "2018-12-11T22:29:00.297000",
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-11T00:00:00",
        "db": "BID",
        "id": "106153"
      },
      {
        "date": "2019-02-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      },
      {
        "date": "2024-11-21T04:03:54.950000",
        "db": "NVD",
        "id": "CVE-2018-2492"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java Input validation vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013092"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-485"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201812-0567",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": null,
        "trust": 0.8,
        "vendor": "sap",
        "version": null
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.10"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106150"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "106150"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-2504",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-2504",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-2504",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-2504",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-2504",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-2504",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201812-479",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50. \nRemote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the  context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. \nSAP NetWeaver AS Java 7.10 ,7.11, 7.20, 7.30, 7.31, 7.40 and 7.50 are vulnerable",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "BID",
        "id": "106150"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-2504",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "106150",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106150"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "id": "VAR-201812-0567",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2024-11-23T22:30:10.568000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Patch Day - December 2018",
        "trust": 0.8,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
      },
      {
        "title": "SAP NetWeaver AS Java Web Container service Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87727"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=508559699"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/106150"
      },
      {
        "trust": 1.6,
        "url": "https://launchpad.support.sap.com/#/notes/2718993"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-2504"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2504"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2718993"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106150"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "106150"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-11T00:00:00",
        "db": "BID",
        "id": "106150"
      },
      {
        "date": "2019-02-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "date": "2018-12-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "date": "2018-12-11T22:29:00.640000",
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-11T00:00:00",
        "db": "BID",
        "id": "106150"
      },
      {
        "date": "2019-02-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      },
      {
        "date": "2024-11-21T04:03:55.793000",
        "db": "NVD",
        "id": "CVE-2018-2504"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java Web Container Service cross-site scripting vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013044"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-479"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201809-0959",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "application server java 7.10 to  7.11"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "application server java 7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "application server java 7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "application server java 7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "application server java 7.40"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "application server java 7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.10"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver as java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.10"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "105325"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "105325"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-2452",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-2452",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-2452",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-2452",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-2452",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-2452",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201809-559",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability. \nRemote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the  context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. \nSAP NetWeaver AS Java 7.10 through 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50 are vulnerable",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "BID",
        "id": "105325"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-2452",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "105325",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "105325"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "id": "VAR-201809-0959",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2024-11-23T21:52:49.027000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Patch Day - September 2018",
        "trust": 0.8,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993"
      },
      {
        "title": "SAP NetWeaver AS Java Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84829"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=499356993"
      },
      {
        "trust": 1.6,
        "url": "https://launchpad.support.sap.com/#/notes/2623846"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/105325"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-2452"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2452"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2623846"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "105325"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "105325"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-09-11T00:00:00",
        "db": "BID",
        "id": "105325"
      },
      {
        "date": "2018-12-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "date": "2018-09-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "date": "2018-09-11T15:29:00.720000",
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-09-11T00:00:00",
        "db": "BID",
        "id": "105325"
      },
      {
        "date": "2018-12-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      },
      {
        "date": "2024-11-21T04:03:50.470000",
        "db": "NVD",
        "id": "CVE-2018-2452"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010218"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201809-559"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201812-0566",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "sap",
        "version": "7.20"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.40"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.11"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.50"
      },
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "7.20"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106156"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sap:netweaver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "106156"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-2503",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.5,
            "id": "CVE-2018-2503",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 1.8,
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-2503",
            "impactScore": 4.0,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Adjacent Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.4,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-2503",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-2503",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-2503",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201812-480",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50). SAP NetWeaver is prone to an information disclosure vulnerability. \nAn attacker can exploit this issue to gain sensitive information, that may aid in further attacks. \nNetWeaver 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 are vulnerable",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "BID",
        "id": "106156"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-2503",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "106156",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106156"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "id": "VAR-201812-0566",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2024-11-23T21:37:55.619000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SAP Security Patch Day - December 2018",
        "trust": 0.8,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
      },
      {
        "title": "SAP NetWeaver AS Java Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87728"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-862",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-285",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=508559699"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/106156"
      },
      {
        "trust": 1.6,
        "url": "https://launchpad.support.sap.com/#/notes/2658279"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-2503"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2503"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2658279"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106156"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "106156"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-11T00:00:00",
        "db": "BID",
        "id": "106156"
      },
      {
        "date": "2019-02-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "date": "2018-12-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "date": "2018-12-11T22:29:00.593000",
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-11T00:00:00",
        "db": "BID",
        "id": "106156"
      },
      {
        "date": "2019-02-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      },
      {
        "date": "2024-11-21T04:03:55.670000",
        "db": "NVD",
        "id": "CVE-2018-2503"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote or local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver AS Java keystore Authorization vulnerabilities in services",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013045"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "lack of information",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-480"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201608-0537",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver application server java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.4"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mathieu GELI (ERPScan)",
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ],
    "trust": 0.3
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver Application Server Java is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.\nRemote attackers can use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to retrieve arbitrary files in the context of the application.            This may aid in further attacks.\nSAP NetWeaver 7.4 is vulnerable.",
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ],
    "trust": 0.3
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "92420",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ]
  },
  "id": "VAR-201608-0537",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.26917922
  },
  "last_update_date": "2022-05-17T01:52:38.359000Z",
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 0.3,
        "url": "www.sap.com/platform/netweaver"
      },
      {
        "trust": 0.3,
        "url": "https://erpscan.com/advisories/erpscan-16-032-sap-netweaver-telnet-console-file-disclosure/"
      },
      {
        "trust": 0.3,
        "url": "https://service.sap.com/sap/support/notes/2280371"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "92420"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-08-08T00:00:00",
        "db": "BID",
        "id": "92420"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-08-08T00:00:00",
        "db": "BID",
        "id": "92420"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver Application Server Java Directory Traversal Vulnerability",
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ],
    "trust": 0.3
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Input Validation Error",
    "sources": [
      {
        "db": "BID",
        "id": "92420"
      }
    ],
    "trust": 0.3
  }
}