{"id":"CVE-2016-2388","published":"2016-02-16T15:59:02Z","modified":"2026-06-17T00:43:57Z","title":"SAP NetWeaver Information Disclosure Vulnerability","vendor":"SAP","product":"NetWeaver","tier":"core","eol":null,"description":{"text":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.","provenance":"source","from":"NVD"},"summary":{"text":"The Universal Worklist Configuration component of SAP NetWeaver AS JAVA 7.4 contains an information disclosure flaw that exposes sensitive user information to unauthorized parties. An remote attacker can exploit it by sending a crafted HTTP request over the network, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:40Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.52206,"percentile":0.98955,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-06-09","dueDate":"2022-06-30","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-2388","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-06-09","exploitedFirstSeen":"2022-06-09","ransomware":false,"evidence":[{"url":"https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs","date":"2022-06-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-09"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2016/May/55","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/39841/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43495/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2016/May/55","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/39841/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43495/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote crafted HTTP request to public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to obtain sensitive user information via a crafted HTTP request","start":66,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Retrieves sensitive user data from the application","mappingType":"primary_impact","evidence":[{"from":"description","quote":"obtain sensitive user information via a crafted HTTP request","start":93,"end":153}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-3472","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-3472","exploited":true,"exploitedSince":"2022-06-09","provenance":"source"},"exploits":[{"id":39841,"url":"https://www.exploit-db.com/exploits/39841","title":"SAP NetWeaver AS JAVA 7.1 < 7.5 - Information Disclosure","type":"webapps","platform":"xml","date":"2016-05-19","verified":false,"provenance":"source"},{"id":43495,"url":"https://www.exploit-db.com/exploits/43495","title":"SAP NetWeaver J2EE Engine 7.40 - SQL Injection","type":"webapps","platform":"multiple","date":"2018-01-10","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2016-05-19"},"first":{"date":"2016-05-19","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39841"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html","http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html","http://seclists.org/fulldisclosure/2016/May/55","https://www.exploit-db.com/exploits/39841/","https://www.exploit-db.com/exploits/43495/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2016-02-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2388","provenance":"source"},{"date":"2016-05-19","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-39841)","url":"https://www.exploit-db.com/exploits/39841","provenance":"source"},{"date":"2022-06-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs","provenance":"source"},{"date":"2022-06-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-3472","provenance":"source"}],"speed":{"daysToPublicExploit":93,"firstExploitFrom":"Exploit-DB","daysToKev":2305},"priority":{"score":66.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1603 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.79,"detail":"percentile 0.9896"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 2 Exploit-DB entries"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}