7.2high
CVE-2017-16682
SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.2
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application.
Exploit prediction (EPSS)
1.59% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- SAP SAP NetWeaver Internet Transaction Server (ITS)
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- securityfocus.com /bid/102143 · vdb-entry, x_refsource_BID, x_transferred
- blogs.sap.com /2017/12/12/sap-security-patch-day-december-2017/ · x_refsource_CONFIRM, x_transferred
- launchpad.support.sap.com /#/notes/2526781 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-16682
- NVD: CVE-2017-16682
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.