CVE-2016-2388 The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
MediumCVSS 5.3
EPSS 52.2%
CISA KEV
added 2022-06-09 · due 2022-06-30
Exploited in the wild
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
CISA Known Exploited Vulnerability
- Date added
- 2022-06-09
- Due date (FCEB)
- 2022-06-30
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver application server java | >= 7.10, <= 7.50 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20160523 [ERPSCAN-16-010] SAP NetWeaver AS JAVA - information disclosure vulnerability exploit mailing-list third-party-advisory
- erpscan.io broken-link third-party-advisory
- erpscan.io broken-link third-party-advisory
- 39841 exploit third-party-advisory vdb-entry
- 43495 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource