CVE-2016-3973: Infoleak
The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wdchat/Chat#, pressing "Add users", and doing a search, aka SAP Security Note 2255990.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3973?
CVE-2016-3973 is considered a medium severity vulnerability due to its information disclosure risk.
How do I fix CVE-2016-3973?
To fix CVE-2016-3973, it is advised to upgrade to a patched version of SAP NetWeaver Java AS that eliminates this vulnerability.
What type of vulnerability is CVE-2016-3973?
CVE-2016-3973 is classified as an information disclosure vulnerability affecting the chat feature in SAP NetWeaver Java AS.
Which versions of SAP NetWeaver are affected by CVE-2016-3973?
CVE-2016-3973 affects SAP NetWeaver Java AS versions 7.1 through 7.5.
What can attackers do with CVE-2016-3973?
Attackers exploiting CVE-2016-3973 can obtain sensitive user information through the missing access controls in the chat feature.