{"id":"CVE-2016-2388","kind":"vulnerability","aliases":["CVE-2016-2388"],"related":[],"title":"sap netweaver application server java: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user…","description":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.\n\nCISA required action: Apply updates per vendor instructions.","summary":"SAP NetWeaver AS Java 7.4 exposes sensitive user information through its Universal Worklist Configuration when sent a crafted HTTP request. An unauthenticated remote attacker can read that user data without logging in.","severity":"medium","cvss":5.3,"epss":0.52206,"exploited":true,"exploited_at":"2022-06-09T00:00:00+00:00","products":[{"name":"SAP NetWeaver","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sap netweaver application server java","fixed":[],"affected":">= 7.10, <= 7.50","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","netweaver","sap","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the SAP update for the Universal Worklist Configuration component per vendor instructions (CISA KEV required action).","status":"open","published_at":"2016-02-16T15:59:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:34+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T21:12:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SAP update for the Universal Worklist Configuration component per vendor instructions (CISA KEV required action).\nunknown","reach":"internet","impact":"low","summary":"SAP NetWeaver AS Java 7.4 exposes sensitive user information through its Universal Worklist Configuration when sent a crafted HTTP request. An unauthenticated remote attacker can read that user data without logging in.","category":"vendor","who_cares":["sap","netweaver","java"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads sensitive user information from the SAP server","analyst_note":"Exploited per CISA KEV and EPSS 0.522, but sources give no fixed version, SAP note number, or detection method; check SAP Security Notes for the Universal Worklist Configuration fix and whether the user info exposed is credentials.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000472,"input_tokens":2841,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':24A,27A '-2388':25A,28A '7.4':15A,45B,81C 'action':97C 'allow':16A,82C 'appli':98C 'applic':3A 'application':33A 'attack':18A,64B,84C 'cisa':95C 'configur':9A,54B,75C 'craft':58B,92C 'cve':23A,26A 'data':69B 'exploit':36B 'expos':46B 'http':59B,93C 'inform':49B,89C 'instruct':102C 'java':5A,14A,35A,37B,44B,80C 'log':71B 'netweav':2A,12A,38B,42B,78C 'netweaver':30A,32A 'obtain':20A,86C 'per':100C 'read':66B 'remot':17A,63B,83C 'request':60B,94C 'requir':96C 'sap':1A,11A,29A,31A,39B,41B,77C 'sensit':21A,47B,87C 'sent':56B 'server':4A,34A 'unauthent':62B 'univers':7A,52B,73C 'updat':99C 'user':22A,48B,68B,88C 'vendor':40B,101C 'via':90C 'without':70B 'worklist':8A,53B,74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-02-16T15:59:02+00:00","kev":{"dateAdded":"2022-06-09","dueDate":"2022-06-30","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-2388","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2388","severity":null,"published_at":"2022-06-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2016-2388","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2388","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-2388","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2388","severity":null,"published_at":"2016-02-16T15:59:02+00:00","modified_at":"2026-06-17T00:43:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}