cbcvebase.
CVE-2017-16691
published 2017-12-12

CVE-2017-16691: SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of…

PriorityP429medium6.5CVSS 3.0
AVNACLPRNUIRSUCNIHAN
EPSS
1.25%
66.0th percentile
SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.

Affected

12 ranges
VendorProductVersion rangeFixed in
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapbusiness_application_software_integrated_solution——
sapsap_note_assistant——

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.