SAP NetWeaver SQL Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-09
• EPSS: 72% chance of exploitation in the next 30 days (higher than 99% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

CISA: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 30 Jun 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlExploitThird Party AdvisoryVDB Entry
• seclists.org/fulldisclosure/2016/May/56ExploitMailing ListThird Party Advisory
• erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerabilityBroken LinkThird Party Advisory
• erpscan.io/press-center/blog/sap-security-notes-february-2016-reviewBroken LinkThird Party Advisory
• github.com/vah13/SAP_exploitExploitThird Party Advisory
• www.exploit-db.com/exploits/39840ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/43495ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource