CVE-2016-2388

sap netweaver application server java

Published 16 Feb 2016 · updated 17 Jun 2026 · Analyzed

5.3 Medium · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 9 Jun 2022, with a remediation deadline of 30 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

References

packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html · Exploit, Third Party Advisory, VDB Entry
seclists.org/fulldisclosure/2016/May/55 · Exploit, Mailing List, Third Party Advisory
erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/ · Broken Link, Third Party Advisory
erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ · Broken Link, Third Party Advisory
www.exploit-db.com/exploits/39841/ · Exploit, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/43495/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388 · US Government Resource