CVE-2017-16691

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-12 · updated 2026-06-17
Weakness: CWE-20

Description

SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.

Affected products

SAP Business Application Software Integrated Solution: 7.00, 7.01, 7.02, 7.10, 7.11, 7.30 (+5)

References

http://www.securityfocus.com/bid/101822
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/
https://launchpad.support.sap.com/#/notes/2546220
http://www.securityfocus.com/bid/101822
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/
https://launchpad.support.sap.com/#/notes/2546220

Get alerted when CVE-2017-16691 or the next vulnerability affects your stack