CVE-2016-3976

CRITICAL · 9.5 CVSS Gepubliceerd: 03-11-2021 CWE-22

Beschrijving

SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a .. (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.

Required action: Apply updates per vendor instructions.

Vendors

Sap

Affected products

Netweaver

References

nvd.nist.gov