CVE-2016-2388
SAP NetWeaver Information Disclosure Vulnerability
Description
CVE-2016-2388 is an information disclosure vulnerability in the Universal Worklist Configuration of SAP NetWeaver AS JAVA 7.4. The flaw allows remote attackers to obtain sensitive user information by sending crafted HTTP requests to the affected component, without requiring any authentication. Exposed information could include usernames, email addresses, and other user directory data that can be leveraged for further targeted attacks. CISA has added CVE-2016-2388 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 62.3% (98th percentile), this SAP NetWeaver information disclosure vulnerability poses a significant threat to organizations running affected versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver application server java | >= 7.10, <= 7.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2016/May/55(Exploit, Mailing List, Third Party Advisory)
- https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/(Broken Link, Third Party Advisory)
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/(Broken Link, Third Party Advisory)
- https://www.exploit-db.com/exploits/39841/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43495/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2016-2388 exploits an information disclosure weakness in SAP NetWeaver's Universal Worklist Configuration, where the application exposes sensitive user data to unauthorized remote actors through crafted HTTP requests. The component fails to properly restrict access to user directory information, allowing any network-accessible attacker to enumerate user accounts and retrieve personal details without authentication.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2016-2388 is a high-severity information disclosure vulnerability that is remotely exploitable without authentication, requiring only a crafted HTTP request to extract sensitive user information from SAP NetWeaver AS JAVA 7.4. The attack complexity is low, meaning no special conditions or configurations are needed for successful exploitation. Confidentiality is the primary impact — the exposed user information can include usernames, email addresses, and organizational data that enables targeted spear-phishing campaigns, credential stuffing attacks, or social engineering. While integrity and availability are not directly affected, the disclosed information significantly amplifies the risk of subsequent attacks. The EPSS score of 62.3% (98th percentile) indicates a very high probability of exploitation, and this vulnerability is commonly chained with CVE-2016-2386 (SQL injection in the same SAP NetWeaver platform) for compounded impact.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2016-2388 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 30, 2022. The EPSS score of 62.3% (98th percentile) reflects sustained and widespread exploitation interest. No specific ransomware campaigns have been attributed to this vulnerability alone, but CVE-2016-2388 is frequently used as a reconnaissance step preceding more severe attacks such as CVE-2016-2386 (SQL injection). The combination of these two vulnerabilities allows attackers to first enumerate valid user accounts through CVE-2016-2388 and then leverage that information for targeted database attacks.
Remediation
- Apply the SAP security patch immediately as directed by the CISA KEV catalog. Install the SAP Security Note that addresses CVE-2016-2388 on all SAP NetWeaver AS JAVA 7.4 instances.
- Restrict network access to the Universal Worklist Configuration endpoint by implementing firewall rules or reverse proxy configurations that limit access to authorized administrators only.
- Audit HTTP access logs for the affected endpoint to identify potential exploitation attempts, looking for unusual request patterns or high-volume requests from external IP addresses targeting user enumeration endpoints.
- Implement network segmentation to isolate SAP NetWeaver application servers from direct internet access, ensuring that administrative interfaces are only reachable from trusted management networks.
- Review and strengthen user account security across the SAP landscape, including enabling multi-factor authentication and monitoring for suspicious login attempts using credentials that may have been obtained through this information disclosure vulnerability.
Technical Details
CVE-2016-2388 is an information disclosure vulnerability in the Universal Worklist Configuration component of SAP NetWeaver Application Server JAVA 7.4. The vulnerability exists because the component does not properly enforce access controls on HTTP endpoints that return user directory information. An unauthenticated attacker can send specially crafted HTTP requests to the vulnerable endpoint and receive responses containing sensitive user data, including user identifiers, email addresses, and potentially organizational hierarchy information. The flaw is straightforward to exploit — it requires only standard HTTP requests with manipulated parameters, making it accessible to attackers with minimal technical sophistication. The disclosed information is particularly valuable as a precursor to more severe attacks against the same SAP environment.
Frequently Asked Questions
Is CVE-2016-2388 being actively exploited?
Yes. CISA has added CVE-2016-2388 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 62.3% (98th percentile) indicates a very high probability of exploitation. This vulnerability is commonly used for reconnaissance before launching more severe attacks against SAP systems.
What products are affected by CVE-2016-2388?
CVE-2016-2388 affects the Universal Worklist Configuration in SAP NetWeaver Application Server JAVA version 7.4. Organizations running this version should check for and apply the SAP Security Note addressing this vulnerability.
How do I fix CVE-2016-2388?
Apply the SAP Security Note that patches CVE-2016-2388 on all affected SAP NetWeaver AS JAVA 7.4 instances. Additionally, restrict network access to the vulnerable endpoint and implement proper access controls to prevent unauthenticated requests to user information endpoints.
How severe is CVE-2016-2388?
CVE-2016-2388 is a high-severity information disclosure vulnerability with an EPSS score of 62.3% in the 98th percentile. While it does not directly enable code execution, the exposed user information facilitates targeted attacks including credential stuffing, spear-phishing, and serves as a stepping stone for exploiting more critical vulnerabilities like CVE-2016-2386.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.