CVE-2016-2388 — SAP NetWeaver Information Disclosure Vulnerability

provenance: imported · CVE: CVE-2016-2388

CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	SAP
Product	NetWeaver
Date added	2022-06-09
Due date	2022-06-30
Ransomware campaign use	Unknown

Description

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2016-2388

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-2388
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog