CVE-2016-2388mediumunder attackCWE-200

CVE-2016-2388

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 5.3epss 52%
from disclosure to weapon93 days
Published on NVDFeb 16
1st PoC+93d
CISA KEV+2305d
Action required by CISAfederal deadline: 2022-06-30

Apply updates per vendor instructions.

In short

SAP NetWeaver AS JAVA 7.4's Universal Worklist Configuration allows attackers to retrieve sensitive user information through specially crafted HTTP requests, potentially exposing confidential data.

Technical detail

CWE-200 information disclosure vulnerability in SAP NetWeaver AS JAVA 7.4's Universal Worklist Configuration allows unauthenticated remote attackers to extract sensitive user data via crafted HTTP requests. The vulnerability requires network access to the affected application and results in unauthorized information exposure.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.