Back to CVE Browser

CVE-2016-2389

HIGH

7.5

CVSS Severity Score

EPSS Score0.0100%

EPSS Percentile18.57th

PublishedFeb 16, 2016

Last ModifiedMay 6, 2026

Vulnerability Description

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.

Affected Platforms (CPE)

📦

Sap

Netweaver

= 7.40

References & Advisories

🔗 http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html

🔗 http://seclists.org/fulldisclosure/2016/May/40

🔗 https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/

🔗 https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/

🔗 https://www.exploit-db.com/exploits/39837/

🔗 http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html

🔗 http://seclists.org/fulldisclosure/2016/May/40

🔗 https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/

Related Vulnerabilities

CVE-2020-2682910.0

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections fro...

CVE-2010-532610.0

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, whic...

CVE-2020-628710.0

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which...

CVE-2012-434110.0

Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of serv...