CVE-2016-9563

published 2016-11-23

CVE-2016-9563: BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the…

Priority P2 77 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

KEV ITW

BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_application_server_java	—	—

Detection & IOCs extracted from sources · hover to see the quote

url sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn↗

• → Monitor for XXE attack patterns (e.g., DOCTYPE declarations, external entity references) in HTTP requests targeting the BC-BMT-BPM-DSK component URI on SAP NetWeaver AS JAVA 7.5 ↗
• → Restrict and alert on authenticated remote access to the BC-BMT-BPM-DSK component endpoint, as exploitation requires only remote authentication ↗

• · Exploitation requires remote authenticated access only — no additional privileges needed, lowering the bar for abuse by any valid SAP account ↗
• · Affected platform is specifically SAP NetWeaver AS JAVA 7.5; confirm version before scoping detection or patching efforts ↗
• · CISA KEV listing confirms active exploitation in the wild; vendor patch (SAP Security Note 2296909) should be treated as urgent ↗

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

vulncheck 6.5 MEDIUM

cisa 6.5 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611