CVE-2016-3974

PoC ×3—

CVSS 3.1

9.1 critical

EPSS

15%p97

Published

Apr 7, 2016 (Apr 7, 2016)

Modified

Jun 17, 2026

Description

XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.

Vendors: sap
Products: netweaver application server java
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (15.1%)

In the news0 stories

No ingested article mentions this CVE yet.