CVE-2016-2388

MediumCVSS 5.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/May/55Exploit, Mailing List, Third Party Advisory
https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/Broken Link, Third Party Advisory
https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/Broken Link, Third Party Advisory
https://www.exploit-db.com/exploits/39841/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/43495/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/May/55Exploit, Mailing List, Third Party Advisory
https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/Broken Link, Third Party Advisory
https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/Broken Link, Third Party Advisory
https://www.exploit-db.com/exploits/39841/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/43495/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388US Government Resource

Timeline

Published: Feb 16, 2016
Last modified: Jun 17, 2026
Added to CISA KEV: Jun 9, 2022
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-23897.5Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 fo CVE-2016-23905.9The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake err CVE-2016-23915.0The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a de CVE-2016-23926.5The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuratio CVE-2016-23937.8Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, whi CVE-2016-23969.9The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remo CVE-2016-23979.8The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers CVE-2016-23986.5Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to d CVE-2016-23997.8Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of servic CVE-2016-24025.9OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain wit CVE-2016-24039.8Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid us CVE-2016-24047.5Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R00