CVE-2016-3976 — SAP NetWeaver Directory Traversal Vulnerability

Description

SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.

Need help remediating this vulnerability?

Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.

Talk to an engineer