6.1med
CVE-2017-16679
URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
0
none known
Summary
URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that allows an attacker to redirect users to a malicious site.
Exploit prediction (EPSS)
0.87% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Affected products
- SAP SAP Startup Service
Classification
- Weakness
- CWE-601 URL Redirection to Untrusted Site
References
- blogs.sap.com /2017/12/12/sap-security-patch-day-december-2017/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/102157 · vdb-entry, x_refsource_BID, x_transferred
- launchpad.support.sap.com /#/notes/2520995 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-16679
- NVD: CVE-2017-16679
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.