ID de Prueba:	1.3.6.1.4.1.25623.1.0.106083
Categoría:	Web Servers
Título:	SAP NetWeaver AS Java Multiple Vulnerabilities (2101079, 2191290, 2256846)
Resumen:	SAP NetWeaver Application Server (AS) Java is prone to multiple; vulnerabilities.
Descripción:	Summary: SAP NetWeaver Application Server (AS) Java is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - CVE-2016-1910: The User Management Engine (UME) allows attackers to decrypt unspecified data via unknown vectors. - CVE-2016-2386: SQL injection vulnerability in the UDDI server. - CVE-2016-2388: The Universal Worklist Configuration allows remote attackers to obtain sensitive user information via a crafted HTTP request. Vulnerability Impact: A remote attacker may execute arbitrary SQL commands or obtain sensitive user information via a crafted HTTP request. Affected Software/OS: SAP NetWeaver AS Java version 7.10 (7.1) through 7.50 (7.5). Solution: See the referenced vendor advisories for a solution. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-1910 BugTraq ID: 80920 http://www.securityfocus.com/bid/80920 https://www.exploit-db.com/exploits/43495/ http://seclists.org/fulldisclosure/2016/Apr/60 https://erpscan.io/advisories/erpscan-16-003-sap-netweaver-7-4-cryptographic-issues/ https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/ Common Vulnerability Exposure (CVE) ID: CVE-2016-2386 https://www.exploit-db.com/exploits/39840/ http://seclists.org/fulldisclosure/2016/May/56 http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ https://github.com/vah13/SAP_exploit Common Vulnerability Exposure (CVE) ID: CVE-2016-2388 https://www.exploit-db.com/exploits/39841/ http://seclists.org/fulldisclosure/2016/May/55 http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/
Copyright	Copyright (C) 2016 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.