CVE-2016-3976: SAP NetWeaver Directory Traversal Vulnerability
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
Other sources
SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3976?
CVE-2016-3976 is classified as a high-severity vulnerability due to its ability to allow unauthorized access to sensitive files.
How do I fix CVE-2016-3976?
To fix CVE-2016-3976, apply the security patches provided in SAP Security Note 2234971.
Who is affected by CVE-2016-3976?
CVE-2016-3976 affects SAP NetWeaver AS Java versions 7.1 through 7.5.
What type of vulnerability is CVE-2016-3976?
CVE-2016-3976 is a directory traversal vulnerability that allows remote attackers to read arbitrary files.
What are the potential impacts of CVE-2016-3976?
The potential impacts of CVE-2016-3976 include data exposure and unauthorized access to sensitive information.