PT-2017-14523 · Sap · Sap Business Intelligence Promotion Management Application

Published 2017-12-12 · Updated 2017-12-22 · CVE-2017-16684

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Intelligence Promotion Management Application versions 4.10 through 4.30

Description The issue concerns the lack of authentication checks for certain functionalities that require user identity.

Recommendations For versions 4.10 through 4.30, consider implementing additional authentication checks for functionalities that require user identity as a temporary workaround until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-16684

Affected Products

Sap Business Intelligence Promotion Management Application

References · 5

• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16684 · Security Note
• https://launchpad.support.sap.com/#/notes/2537152 · Note
• http://securityfocus.com/bid/102147 · Note