CVEvulnerability

CVE-2017-16691

6.5 MEDIUM Published 2017-12-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-12-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
CWE-20

Description

SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.

Affected configurations

• sap business application software integrated solution 7.00 • sap business application software integrated solution 7.01 • sap business application software integrated solution 7.02 • sap business application software integrated solution 7.10 • sap business application software integrated solution 7.11 • sap business application software integrated solution 7.30 • sap business application software integrated solution 7.31 • sap business application software integrated solution 7.40 • sap business application software integrated solution 7.50 • sap business application software integrated solution 7.51 • sap business application software integrated solution 7.52

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References