Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2016-4014: SAP NetWeaver Java 7.4 UDDI may freeze on bad XML
CVE-2016-4014 · published 10 years ago
Summary
The UDDI service in SAP NetWeaver Java Application Server version 7.4 can stop responding if it receives a specially crafted XML document. This can make the system hang, disrupting business processes that rely on the service. Apply the security update referenced in SAP Security Note 2254389 or upgrade to a patched version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap | netweaver |
7.4 cpe:2.3:a:sap:netweaver:7.4:*:*:*:java_as:*:*:* |
Original advisory text
XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in an XML request to ...
XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389.
References
- http://packetstormsecurity.com/files/137919/SAP-NetWeaver-AS-JAVA-7.4-XXE-Inject... Exploit Third Party Advisory VDB Entry
- http://seclists.org/fulldisclosure/2016/Jul/45 Exploit Third Party Advisory
- https://erpscan.io/advisories/erpscan-16-020-sap-netweaver-java-uddi-component-x...
- https://erpscan.io/press-center/blog/dos-vulnerabilities-on-the-rise-sap-securit...
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 Apr 2016
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-4014 · NVD
Track software like this
Free during beta