PT-2017-17894 · Sap · Sap As Java Sso Authentication Library

Published 2017-04-14 · Updated 2019-10-03 · CVE-2017-7696

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP AS JAVA SSO Authentication Library versions 2.0 through 3.0

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by providing large values in the width and height parameters to the "otp logon ui resources/qr" API endpoint.

Recommendations For SAP AS JAVA SSO Authentication Library versions 2.0 through 3.0, restrict access to the "otp logon ui resources/qr" API endpoint to minimize the risk of exploitation. Avoid using large values in the width and height parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2017-7696

Affected Products

Sap As Java Sso Authentication Library

References · 3

• https://osv.dev/vulnerability/CVE-2017-7696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7696 · Security Note
• https://erpscan.io/advisories/erpscan-17-001-sap-java-dos-bc-iam-sso-otp-package-use-qr-servlet · Note