CVE-2016-2389

HIGH EXPLOITED NUCLEI

SAP Netweaver - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.

Exploits (1)

exploitdb WORKING POC
by ERPScan · textwebappsjava
https://www.exploit-db.com/exploits/39837

Nuclei Templates (1)

SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion
HIGHby daffainfo
Shodan: http.favicon.hash:-266008933 || cpe:"cpe:2.3:a:sap:netweaver"
FOFA: icon_hash=-266008933

References (5)

Scores

CVSS v3 7.5
EPSS 0.8368
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2025-06-08
CWE
CWE-22
Status published
Products (1)
sap/netweaver 7.40
Published Feb 16, 2016
Tracked Since Feb 18, 2026