CVE-2017-16678

4.7MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver Knowledge Management Configuration Service
Vendor
CVE Published:
12 December 2017

Summary

Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.

Affected Version(s)

SAP NetWeaver Knowledge Management Configuration Service EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50

References

https://launchpad.support.sap.com/#/notes/2457562
x_refsource_CONFIRM
https://blogs.sap.com/2017/12/12/sap-security-patch-day-d...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/102149
vdb-entryx_refsource_BID

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.