CVE-2016-2388 – SAP NetWeaver Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2016-2388

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. El Universal Worklist Configuration en SAP NetWeaver AS JAVA 7.4 permite a los atacantes remotos obtener información sensible de los usuarios a través de una solicitud HTTP manipulada, también conocida como SAP Security Note 2256846 SAP NetWeaver AS JAVA versions 7.1 through 7.5 suffer from an information disclosure vulnerability. The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. • https://www.exploit-db.com/exploits/43495 https://www.exploit-db.com/exploits/39841 http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html http://seclists.org/fulldisclosure/2016/May/55 https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •