5.3
CVSSv3

CVE-2016-2388

Published: 16/02/2016 Updated: 05/05/2021
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9
VMScore: 510
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote malicious users to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

sap netweaver application server java

Exploits

Application:SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 71 - 75 Vendor URL: SAPcom Bugs: information disclosure Sent: 15092015 Reported: 15092015 Vendor response: 16092015 Date of Public Advisory: 09022016 Reference: SAP Security Note 2256846 Author: Vahagn Vardanyan (ERPScan) Description 1 ADVISORY INF ...
#!/usr/bin/env python # coding=utf-8 """ Author: Vahagn Vardanyan twittercom/vah_13 Bugs: CVE-2016-2386 SQL injection CVE-2016-2388 Information disclosure CVE-2016-1910 Crypto issue Follow HTTP request is a simple PoC for anon time-based SQL injection (CVE-2016-2386) vulnerability in SAP NetWeaver AS Java UDDI 711-750 POST /UD ...
SAP NetWeaver AS JAVA versions 71 through 75 suffer from an information disclosure vulnerability ...
SAP NetWeaver J2EE Engine version 740 suffers from a remote SQL injection vulnerability ...

Github Repositories

Here you can get full exploit for SAP NetWeaver AS JAVA

SAP_exploit Author: Vahagn Vardanyan twittercom/vah_13 Bugs: CVE-2016-2386 SQL injection CVE-2016-2388 Information disclosure CVE-2016-1910 Crypto issue Follow HTTP request is a simple PoC for anon time-based SQL injection (CVE-2016-2386) vulnerability in SAP NetWeaver AS Java UDDI 711-750 POST /UDDISecurityService/UDDISecurityImplBean HTTP/11 User-Agent:

Recent Articles

Microsoft fixes under-attack Windows zero-day Follina
The Register • Jessica Lyons Hardcastle • 01 Jan 1970

Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Plus: Intel, AMD react to Hertzbleed data-leaking holes in CPUs

Patch Tuesday Microsoft claims to have finally fixed the Follina zero-day flaw in Windows as part of its June Patch Tuesday batch, which included security updates to address 55 vulnerabilities. Follina, eventually acknowledged by Redmond in a security advisory last month, is the most significant of the bunch as it has already been exploited in the wild. Criminals and snoops can abuse the remote code execution (RCE) bug, tracked as CVE-2022-30190, by crafting a file, such as a Word document, so t...