CVE-2016-3974: sap netweaver_application_server_java
Vulnerability summary
CVE-2016-3974 is a critical (CVSS 9.1) vulnerability in sap netweaver_application_server_java. EPSS estimates a 15.06% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 07-04-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
15.06%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 15.06% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
SAP NetWeaver AS JAVA 7.1 < 7.5 - 'ctcprotocol Servlet' XML External Entity
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_application_server_java≥ 7.10, ≤ 7.50
1 vendor · 1 product
References
5 links- erpscan.io/advisories/erpscan-16-013-sap-netweaver-7-4-ctcprotocol-servlet-xxe/X Refsource MISCThird Party Advisory
- erpscan.io/press-center/blog/sap-security-notes-march-2016-review/X Refsource MISCThird Party Advisory
- packetstormsecurity.com/files/137527/SAP-NetWeaver-AS-JAVA-7.5-XXE-Injection.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry