CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
Published Feb 16, 2016 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
References
- https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
- https://www.exploit-db.com/exploits/39841/
- https://www.exploit-db.com/exploits/43495/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More SAP vulnerabilities
All SAP entriesCVE-2025-42999
SAP NetWeaver Deserialization Vulnerability
critical9.1ExploitedMay 13, 2025CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
critical9.8ExploitedApr 24, 2025CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
critical10.0ExploitedFeb 9, 2022CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
high8.8ExploitedSep 14, 2021CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
critical10.0ExploitedJul 14, 2020CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
critical9.8ExploitedMar 10, 2020