Medium severity · published Feb 16, 2016
CVE-2016-2387
Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or…
6.1
CVSS
1.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netweaver · Sap
7.40 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2387
packetstormsecurity.com
http://packetstormsecurity.com/files/137045/SAP-NetWeaver-AS-JAVA-7.4-Cross-Site-Scripting.html
seclists.org
http://seclists.org/fulldisclosure/2016/May/39
erpscan.io
https://erpscan.io/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability/
erpscan.io
https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
More from Netweaver
10.0
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
10.0
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
9.8
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
9.8
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
9.1
CVE-2025-42999
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)