PT-2016-1282 · Sap · Sap Netweaver As Java

Vahagn Vardanyan · Published 2016-02-16 · Updated 2025-02-04 · CVE-2016-2388

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.4

Description The issue is related to insufficient access control in the Universal Worklist Configuration component of SAP NetWeaver, allowing remote attackers to obtain sensitive user information via a crafted HTTP request.

Recommendations For SAP NetWeaver AS JAVA version 7.4, apply the fix as described in SAP Security Note 2256846 to resolve the issue.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2016-00579

CVE-2016-2388

Affected Products

Sap Netweaver As Java

References · 18

• 🔥 https://github.com/vah13/SAP_exploit · Exploit
• 🔥 http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/39841 · Exploit
• 🔥 https://exploit-db.com/exploits/43495 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/May/55 · Exploit
• 🔥 http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html · Exploit
• https://bdu.fstec.ru/vul/2016-00579 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2388 · Security Note
• https://t.me/cvenotify/108269 · Telegram Post
• https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure · Note
• https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure · Note
• https://erpscan.com/press-center/blog/sap-security-notes-february-2016-review · Note
• https://t.me/cvenotify/13806 · Telegram Post
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review · Note