Actively exploited · Published Feb 16, 2016 · Assigned by mitre
CVE-2016-2388
Medium 5.3 Exploited
In plain English
A medium-severity information exposure in NetWeaver from SAP. Attackers are actively exploiting it in the wild (listed by CISA on June 9, 2022). The chance it is exploited in the next 30 days is estimated at 52.2% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)52.2%top 1.0% of all CVEs
Exploited in the wildYesCISA KEV since Jun 9, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 30, 2022.
Official description
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- 20160523 [ERPSCAN-16-010] SAP NetWeaver AS JAVA - information disclosure vulnerability mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html x_refsource_MISC
- https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/ x_refsource_MISC
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ x_refsource_MISC
- 39841 exploit, x_refsource_EXPLOIT-DB
- 43495 exploit, x_refsource_EXPLOIT-DB
- http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388 government-resource