CVE-2016-3973 The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/r...
MediumCVSS 5.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtc~wd_chat/Chat#, pressing "Add users", and doing a search, aka SAP Security Note 2255990.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver application server java | >= 7.10, <= 7.50 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160621 [ERPSCAN-16-016] SAP NetWeaver Java AS WD_CHAT - Information disclosure vulnerability mailing-list third-party-advisory
- erpscan.io third-party-advisory
- erpscan.io third-party-advisory