Vulnerability Details : CVE-2017-16689
A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting Relation to the same system has been defined.
Vulnerability category: BypassGain privilege
Products affected by CVE-2017-16689
- cpe:2.3:a:sap:sap_kernel:7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_kernel:7.49:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_kernel:7.22ext:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_kernel:7.21:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_kernel:7.45:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_kernel:7.21ext:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-16689
0.35%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-16689
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-16689
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-16689
-
http://www.securityfocus.com/bid/102144
SAP Kernel CVE-2017-16689 Authentication Bypass VulnerabilityThird Party Advisory;VDB Entry
-
https://launchpad.support.sap.com/#/notes/2449757
SAP ONE Support Launchpad: Log OnPermissions Required;Vendor Advisory
-
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/
SAP Security Patch Day – December 2017 | SAP BlogsIssue Tracking;Vendor Advisory
Jump to