PT-2017-17894 · Sap · Sap As Java Sso Authentication Library

Publicado 2017-04-14 · Atualizado 2019-10-03 · CVE-2017-7696

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP AS JAVA SSO Authentication Library versions 2.0 through 3.0

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by providing large values in the width and height parameters to the "otp logon ui resources/qr" API endpoint.

Recommendations For SAP AS JAVA SSO Authentication Library versions 2.0 through 3.0, restrict access to the "otp logon ui resources/qr" API endpoint to minimize the risk of exploitation. Avoid using large values in the width and height parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2017-7696

Produtos afetados

Sap As Java Sso Authentication Library

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-7696 · Aviso do Fabricante
• https://erpscan.io/advisories/erpscan-17-001-sap-java-dos-bc-iam-sso-otp-package-use-qr-servlet · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7696 · Nota de Segurança