ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2016-3635

—
CVSS 3.0
7.5 high
EPSS
2%p83
Published
()
Modified
Description

SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly, aka SAP Security Note 2139366.

Vendors
sap
Products
netweaver
Weakness
CWE-284
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news

No ingested article mentions this CVE yet.