CVE-2016-2386 SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
CriticalCVSS 9.8
EPSS 71.5%
CISA KEV
added 2022-06-09 · due 2022-06-30
Exploited in the wild
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
CISA Known Exploited Vulnerability
- Date added
- 2022-06-09
- Due date (FCEB)
- 2022-06-30
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver application server java | = 7.40 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20160523 [ERPSCAN-16-011] SAP NetWeaver AS JAVA - SQL injection vulnerability exploit mailing-list third-party-advisory
- erpscan.io broken-link third-party-advisory
- erpscan.io broken-link third-party-advisory
- github.com exploit third-party-advisory
- 39840 exploit third-party-advisory vdb-entry
- 43495 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource