# CVE-2016-2389: SAP NetWeaver - Path Traversal

> Live exploitation tracking for CVE-2016-2389 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2016-2389

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** SAP NetWeaver
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.

## CrowdSec analysis

[CVE-2016-2389](https://euvd.enisa.europa.eu/vulnerability/CVE-2016-2389) is a vulnerability in SAP Manufacturing Integration and Intelligence (xMII) that allows remote attackers to read arbitrary files due to improper validation of input paths in catalog requests, leading to a directory traversal scenario.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of May 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2016-2389 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2016-2389 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2016-2389 is currently experiencing high visibility and active exploitation across the internet.

Attempts to exploit this vulnerability typically involve requests to URLs containing `/xmii/catalog` with malicious path traversal sequences.

## Timeline

- 2016-02-16: CVE Published. CVE-2016-2389 is published to NVD.
- 2025-05-23: Rule Released. CrowdSec releases a rule to detect CVE-2016-2389 exploitation attempts against the CrowdSec Network.
- 2025-05-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2016-2389 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-2389.yaml
- https://www.exploit-db.com/exploits/39837/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2016-2389) follows observed exploitation activity for CVE-2016-2389. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.