ZeroDay Findings
Sign inSign up

Findings

CVE-2016-2388

SAP NetWeaver Information Disclosure Vulnerability

Published Feb 16, 2016 · updated Jun 16, 2026 · sap netweaver application server java

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 16, 2016 · Catalog

    Detected

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

  2. Jun 9, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 30, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

Required action

Apply updates per vendor instructions.

CISA due date Jun 30, 2022

Affected

  • cpe sap/netweaver application server javaversion unspecified
  • vendor SAP NetWeaverversion unspecified

Sources

  • CISA KEVCVE-2016-2388

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

    cisa.gov
  • CVE.orgCVE-2016-2388

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2016-2388

    30-day exploitation probability 52.2%

    first.org
  • Exploit Database39841

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database43495

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2016-2388

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References