PT-2017-14518 · Sap · Sap Kernel

Published 2017-12-12 · Updated 2018-01-04 · CVE-2017-16679

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP KERNEL 32 NUC versions 7.21 through 7.22 SAP KERNEL 32 Unicode versions 7.21 through 7.22 SAP KERNEL 64 NUC versions 7.21 through 7.22 SAP KERNEL 64 Unicode versions 7.21 through 7.22 SAP KERNEL versions 7.21 through 7.52

Description The issue allows an attacker to redirect users to a malicious site through a URL redirection vulnerability in SAP's Startup Service.

Recommendations For SAP KERNEL 32 NUC versions 7.21 through 7.22, update to a version outside of this range to resolve the issue. For SAP KERNEL 32 Unicode versions 7.21 through 7.22, update to a version outside of this range to resolve the issue. For SAP KERNEL 64 NUC versions 7.21 through 7.22, update to a version outside of this range to resolve the issue. For SAP KERNEL 64 Unicode versions 7.21 through 7.22, update to a version outside of this range to resolve the issue. For SAP KERNEL versions 7.21 through 7.52, update to a version outside of this range to resolve the issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2017-16679

Affected Products

Sap Kernel

References · 5

• https://osv.dev/vulnerability/CVE-2017-16679 · Vendor Advisory
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16679 · Security Note
• https://launchpad.support.sap.com/#/notes/2520995 · Vendor Advisory
• http://securityfocus.com/bid/102157 · Note