CVE-2017-16680 - CVE House

Back to Database

Status published High CVE-2017-16680

Two potential audit log injections in SAP HANA extended application...

7.5 CVSS

Vulnerability Description

Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input validation which could allow unprivileged attackers to forge audit log lines. Hence the interpretation of audit log files could be hindered or misdirected. 2) User Account and Authentication writes audit logs into syslog and additionally writes the same audit entries into a log file. Entries in the log file miss escaping. Hence the interpretation of audit log files could be hindered or misdirected, while the entries in syslog are correct.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16680

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP

View All →

HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)

DLL Hijacking vulnerability in SapSetup (Software Installation Program)

Directory/Path Traversal vulnerability in SAP NetWeaver.

Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)

Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)

Affected Vendor

SAP

View all reports →

Affected Software

SAP HANA extended application services

Vulnerable Versions:

1.0

Timeline

Official Publish: December 12th, 2017

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.