CVE-2016-2388
published 2016-02-16CVE-2016-2388: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka…
PriorityP278medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-30
Exploited in the wild
EPSS
51.55%
98.8th percentile
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver_application_server_java | 7.10 – 7.50 | — |
Detection & IOCsextracted from sources · hover to see the quote
command1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%SHA-512%') AND '1'='1↗
snort↗
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Vulnerable SAP NetWeaver Path Observed - Information Disclosure (CVE-2016-2388)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/webdynpro/resources/"; content:"/JWFTestAddAssignees#"; fast_pattern; reference:cve,2016-2388; classtype:attempted-recon; sid:2038697; rev:3; metadata:attack_target Web_Server, created_at 2022_08_31, cve CVE_2016_2388, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery; target:dest_ip;)
- →Detect unauthenticated HTTP GET requests targeting the Universal Worklist path /webdynpro/resources/ combined with /JWFTestAddAssignees# — the primary exploitation vector for CVE-2016-2388. ↗
- →Monitor for unauthenticated HTTP GET requests to the SAP WebDynpro chat application paths /tc~rtc~coll.appl.rtc~wd_chat/Chat# and /tc~rtc~coll.appl.rtc~wd_chat/Messages# which also expose SAP user lists. ↗
- →Monitor for unauthenticated POST requests to /UDDISecurityService/UDDISecurityImplBean on port 50000 with Content-Type text/xml, which is the companion SQL injection (CVE-2016-2386) endpoint used in chained attacks alongside CVE-2016-2388. ↗
- →Look for the string PRIVATE_DATASOURCE.un: in HTTP request bodies targeting SAP endpoints, indicating an attacker is probing for user credentials via SQL injection payloads chained with the information disclosure. ↗
- →The exploit triggers a 'Search' action on the Universal Worklist without authentication; alert on anonymous access (no session cookie / auth header) to /webdynpro/resources/ paths returning user list data. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck5.3MEDIUM
cisa5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP NetWeaver 7.4 Universal Worklist Configuration access control (ID 2256846 / EDB-39841)
vuldb·2026-04-23·CVSS 5.3
CVE-2016-2388 [MEDIUM] SAP NetWeaver 7.4 Universal Worklist Configuration access control (ID 2256846 / EDB-39841)
A vulnerability marked as problematic has been reported in SAP NetWeaver 7.4. This affects an unknown function of the component Universal Worklist Configuration. This manipulation causes improper access controls.
This vulnerability is handled as CVE-2016-2388. The attack can be initiated remotely. Additionally, an exploit exists.
GHSA
GHSA-56qq-x77r-g35x: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7
ghsa_unreviewed·2022-05-13
CVE-2016-2388 [MEDIUM] CWE-200 GHSA-56qq-x77r-g35x: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
VulnCheck
SAP NetWeaver Information Disclosure Vulnerability
vulncheck·2016·CVSS 5.3
CVE-2016-2388 [MEDIUM] CWE-200 SAP NetWeaver Information Disclosure Vulnerability
SAP NetWeaver Information Disclosure Vulnerability
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Affected: SAP NetWeaver
Required Action: Apply updates per vendor instructions.
Exploitation References: https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/c34824a10b75
Remediation Due: 2022-06-30
CISA
SAP NetWeaver Information Disclosure Vulnerability
cisa·2022-06-09·CVSS 5.3
CVE-2016-2388 [MEDIUM] CWE-200 SAP NetWeaver Information Disclosure Vulnerability
Vulnerability: SAP NetWeaver Information Disclosure Vulnerability
Affected: SAP NetWeaver
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-2388
Remediation Due Date: 2022-06-30
Suricata
ET WEB_SPECIFIC_APPS Vulnerable SAP NetWeaver Path Observed - Information Disclosure (CVE-2016-2388)
suricata·2022-08-31·CVSS 5.3
CVE-2016-2388 [MEDIUM] ET WEB_SPECIFIC_APPS Vulnerable SAP NetWeaver Path Observed - Information Disclosure (CVE-2016-2388)
ET WEB_SPECIFIC_APPS Vulnerable SAP NetWeaver Path Observed - Information Disclosure (CVE-2016-2388)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Vulnerable SAP NetWeaver Path Observed - Information Disclosure (CVE-2016-2388)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/webdynpro/resources/"; content:"/JWFTestAddAssignees#"; fast_pattern; reference:cve,2016-2388; classtype:attempted-recon; sid:2038697; rev:3; metadata:attack_target Web_Server, created_at 2022_08_31, cve CVE_2016_2388, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mit
Exploit-DB
SAP NetWeaver J2EE Engine 7.40 - SQL Injection
exploitdb·2018-01-10·CVSS 5.3
CVE-2016-2388 [MEDIUM] SAP NetWeaver J2EE Engine 7.40 - SQL Injection
SAP NetWeaver J2EE Engine 7.40 - SQL Injection
---
#!/usr/bin/env python
# coding=utf-8
"""
Author: Vahagn Vardanyan https://twitter.com/vah_13
Bugs:
CVE-2016-2386 SQL injection
CVE-2016-2388 Information disclosure
CVE-2016-1910 Crypto issue
Follow HTTP request is a simple PoC for anon time-based SQL injection (CVE-2016-2386) vulnerability in SAP NetWeaver AS Java UDDI 7.11-7.50
POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
SOAPAction:
Content-Type: text/xml;charset=UTF-8
Host: nw74:50000
Content-Length: 500
1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%SHA-512%') AND '1'='
Exploit-DB
SAP NetWeaver AS JAVA 7.1 < 7.5 - Information Disclosure
exploitdb·2016-05-19·CVSS 5.3
CVE-2016-2388 [MEDIUM] SAP NetWeaver AS JAVA 7.1 < 7.5 - Information Disclosure
SAP NetWeaver AS JAVA 7.1 < 7.5 - Information Disclosure
---
Application:SAP NetWeaver AS JAVA
Versions Affected: SAP NetWeaver AS JAVA 7.1 - 7.5
Vendor URL: http://SAP.com
Bugs: information disclosure
Sent: 15.09.2015
Reported: 15.09.2015
Vendor response: 16.09.2015
Date of Public Advisory: 09.02.2016
Reference: SAP Security Note 2256846
Author: Vahagn Vardanyan (ERPScan)
Description
1. ADVISORY INFORMATION
Title: SAP NetWeaver AS JAVA – information disclosure vulnerability
Advisory ID: [ERPSCAN-16-010]
Risk: Medium
Advisory URL: https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/
Date published: 09.02.2016
Vendors contacted: SAP
2. VULNERABILITY INFORMATION
Class: Information disclosure
Impact: Resource consumption
Remotely Exploitable: Yes
Lo
No writeups or analysis indexed.
http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.htmlhttp://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2016/May/55https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/https://www.exploit-db.com/exploits/39841/https://www.exploit-db.com/exploits/43495/http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.htmlhttp://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2016/May/55https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/https://www.exploit-db.com/exploits/39841/https://www.exploit-db.com/exploits/43495/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388
2016-02-16
Published
2022-06-09
Added to CISA KEV
Exploited in the wild