Medium severity6.5NVD Advisory· Published Dec 12, 2017· Updated May 13, 2026
CVE-2017-16691
CVE-2017-16691
Description
SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.
Affected products
12- SAP/SAP Note Assistantv5Range: SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52
cpe:2.3:a:sap:business_application_software_integrated_solution:7.51:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.51:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.52:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.00:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.01:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.02:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.11:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:business_application_software_integrated_solution:7.50:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.securityfocus.com/bid/101822nvdThird Party AdvisoryVDB Entry
- blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/nvdIssue TrackingVendor Advisory
- launchpad.support.sap.comnvdPermissions RequiredVendor Advisory
News mentions
0No linked articles in our index yet.