返回 CVE 瀏覽器

CVE-2016-2389

HIGH

7.5

CVSS Severity Score

EPSS Score0.0100%

EPSS Percentile18.57th

Published2016年2月16日

Last Modified2026年5月6日

Vulnerability Description

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.

Affected Platforms (CPE)

📦

Sap

Netweaver

= 7.40

References & Advisories

🔗 http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html

🔗 http://seclists.org/fulldisclosure/2016/May/40

🔗 https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/

🔗 https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/

🔗 https://www.exploit-db.com/exploits/39837/

🔗 http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html

🔗 http://seclists.org/fulldisclosure/2016/May/40

🔗 https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/

相關漏洞威脅

CVE-2020-2682910.0

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections fro...

CVE-2010-532610.0

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, whic...

CVE-2020-628710.0

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which...

CVE-2012-434110.0

Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of serv...