CVE-2016-2388

CVE-2016-2388 is an unauthenticated information disclosure flaw (CWE-200) in the Universal Worklist (UWL) configuration component of SAP NetWeaver Application Server (AS) Java 7.4, addressed by SAP Security Note 2256846. A remote attacker triggers it by sending a specially crafted HTTP request to the UWL configuration interface without any credentials. Successful exploitation discloses sensitive user information stored by the system (low confidentiality impact only, with no integrity or availability impact per the CVSS vector). Any organization running SAP NetWeaver AS Java 7.4 — particularly where the UWL configuration interface is reachable from untrusted networks — is affected. Public proof-of-concept code has circulated since 2016, EPSS assigns a 51.6% 30-day exploitation probability (99th percentile), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-06-09, confirming exploitation in the wild; any ransomware association is unknown.

What to do: Apply the fix for SAP Security Note 2256846 or move NetWeaver AS Java to a patched release per SAP's vendor instructions, prioritizing internet-facing systems (patching is mandatory for US federal agencies under the KEV listing). Restrict network access to the UWL configuration interface, and review HTTP access logs for unexpected unauthenticated requests against UWL endpoints, since available PoCs are simple crafted HTTP requests.