sap netweaver-application-server-java CVE-2016-2388 is a vulnerability in SAP Netweaver Application Server Java
Published on February 16, 2016

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

NVD

Known Exploited Vulnerability

This SAP NetWeaver Information Disclorsure Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

The following remediation steps are recommended / required by June 30, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2016-2388 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2016-2388 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2016-2388

You can be notified by stack.watch whenever vulnerabilities like CVE-2016-2388 are published in these products:

SAP Netweaver Application Server Java
 

What versions of Netweaver Application Server Java are vulnerable to CVE-2016-2388?