CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability

EPSS trend

Probability

52.21%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 52.21% on 21-09-2026

21-09-202621-10-2026

EPSS score

52.21%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 09-06-2022
Federal due date: 30-06-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2016-2388

Public exploits

5 found

referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 5 exploits

exploit-databasemultipleUnverified
SAP NetWeaver J2EE Engine 7.40 - SQL Injection
Maturity: poc
exploit-databasexmlUnverified
SAP NetWeaver AS JAVA 7.1 < 7.5 - Information Disclosure
Maturity: poc

References

8 links

seclists.org/fulldisclosure/2016/May/55Mailing ListX Refsource FULLDISCExploitThird Party Advisory
packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/X Refsource MISCBroken LinkThird Party Advisory
erpscan.io/press-center/blog/sap-security-notes-february-2016-review/X Refsource MISCBroken LinkThird Party Advisory
www.exploit-db.com/exploits/39841/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/43495/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388Government ResourceUS Government Resource

Related vulnerabilities

CVE-2018-2504sapnetweaver_application_server_java+11.06%7y ago11-12-2018 23:00SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.CVE-2018-2503sapnetweaver_application_server_java+10.57%7y ago11-12-2018 23:00By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).CVE-2018-2452sapnetweaver_application_server_java+11.42%8y ago11-09-2018 15:00The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.CVE-2018-2492sapnetweaver_application_server_java+11.11%7y ago11-12-2018 23:00SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.CVE-2021-21485sap sesap netweaver as for java (telnet commands)+10.94%5y ago13-04-2021 18:44An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user.CVE-2021-21491sap sesap netweaver application server java (applications based on web dynpro java)+10.69%5y ago10-03-2021 14:11SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

All vulnerabilities innetweaver_application_server_java

CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References