CVE-2016-9563
SAP NetWeaver XML External Entity (XXE) Vulnerability
Description
CVE-2016-9563 is a medium-severity XML External Entity (XXE) vulnerability in SAP NetWeaver Application Server Java. The BC-BMT-BPM-DSK component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XXE attacks via the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 58.44% (98.2nd percentile), CVE-2016-9563 has a very high probability of exploitation, making it a priority for organizations running affected SAP NetWeaver Java platforms.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver application server java | 7.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- http://www.securityfocus.com/bid/92419(Broken Link, Third Party Advisory, VDB Entry)
- https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/(Broken Link, Third Party Advisory)
- https://launchpad.support.sap.com/#/notes/2296909(Permissions Required)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9563(US Government Resource)
Weakness Type
CWE-611: Improper Restriction of XML External Entity Reference
XML External Entity (XXE) occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. In the case of SAP NetWeaver AS JAVA, the BC-BMT-BPM-DSK component fails to properly restrict external entity references in XML input, allowing authenticated attackers to read arbitrary files, perform server-side request forgery, or cause denial of service.
Learn more: CWE-611 — Improper Restriction of XML External Entity Reference
Impact Analysis
CVE-2016-9563 carries a CVSS 3.1 score of 6.5 (MEDIUM), reflecting a significant information disclosure risk. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires low-level authentication. No user interaction is needed, and the scope is unchanged. The primary impact is on confidentiality, which is rated high, meaning an attacker can potentially access sensitive data including server-side files, configuration data, and internal network information through the XXE attack. Integrity and availability are not directly impacted. The EPSS score of 58.44% (98.2nd percentile) indicates a very high probability of active exploitation. Organizations running SAP NetWeaver AS JAVA 7.5 with the affected BPM component face significant data exfiltration risk.
Exploit Maturity
CVE-2016-9563 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 58.44% (98.2nd percentile) indicates a very high probability of exploitation activity, placing this vulnerability among the most likely to be exploited. While no specific public exploit code is tagged in the NVD references, the well-understood nature of XXE attacks and the straightforward exploitation path via the bpemuwlconn URI make this vulnerability readily exploitable by attackers with basic SAP access. Federal agencies were required to remediate this vulnerability by 2022-05-03.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. SAP Security Note 2296909 addresses this XXE vulnerability.
- Upgrade SAP NetWeaver Application Server Java 7.50 to the latest patched version that includes the fix for the BC-BMT-BPM-DSK component.
- Disable external entity processing in XML parsers used by the affected component. Configure the XML parser to disallow DTDs entirely or set secure processing features to prevent external entity resolution.
- Restrict network access to the sap.com
tcbpemhimuwlconnproviderweb/bpemuwlconn endpoint using web application firewall rules or reverse proxy configurations, and limit access to only authorized users who require BPM functionality. - Monitor server logs for suspicious XML requests to the affected endpoint, looking for patterns indicative of XXE exploitation such as external entity declarations referencing file:// or http:// protocols.
Technical Details
CVE-2016-9563 is an XML External Entity (XXE) vulnerability in the BC-BMT-BPM-DSK component of SAP NetWeaver AS JAVA 7.5. The vulnerability exists in the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI endpoint, where the XML parser is configured without proper restrictions on external entity references. An authenticated attacker can craft malicious XML input containing external entity declarations that reference local files or internal network resources, causing the server to process these references and return the contents. The attack vector is network-based with low complexity (CVSS vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), requiring only low-level authentication. The high confidentiality impact with no integrity or availability impact is characteristic of XXE attacks focused on data exfiltration.
Frequently Asked Questions
Is CVE-2016-9563 being actively exploited?
Yes. CVE-2016-9563 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 58.44% (98.2nd percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2016-9563?
CVE-2016-9563 affects SAP NetWeaver Application Server Java version 7.50. Specifically, the BC-BMT-BPM-DSK component is vulnerable through the bpemuwlconn web provider URI.
How do I fix CVE-2016-9563?
Apply updates per SAP vendor instructions, specifically SAP Security Note 2296909. Upgrade the affected SAP NetWeaver AS JAVA 7.50 instance to the latest patched version. As an interim measure, disable external entity processing in XML parsers and restrict access to the affected endpoint.
How severe is CVE-2016-9563?
CVE-2016-9563 has a CVSS 3.1 score of 6.5 (MEDIUM). While the base severity is medium, the very high EPSS score of 58.44% (98.2nd percentile) and confirmed active exploitation in the CISA KEV catalog make this a high-priority vulnerability requiring prompt remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.