CVE-2017-16678

Current Description

Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.

Basic Data

PublishedDecember 12, 2017
Last ModifiedJanuary 02, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-918
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationSINGLE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score6.5
SeverityMEDIUM
Exploitability Score8.0
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

CVSS 3 - Version3.0
CVSS 3 - Vector StringCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3 - Attack VectorNETWORK
CVSS 3 - Attack ComplexityLOW
CVSS 3 - Privileges RequiredHIGH
CVSS 3 - User InteractionNONE
CVSS 3 - ScopeUNCHANGED
CVSS 3 - Confidentiality ImpactLOW
CVSS 3 - Integrity ImpactLOW
CVSS 3 - Availability ImpactLOW
CVSS 3 - Base Score4.7
CVSS 3 - Base SeverityMEDIUM
Exploitability Score1.2
Base SeverityMEDIUM

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSapNetweaver Knowledge Management Configuration Service-*******
  • OR - Configuration 2
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSapEpbc********7.007.02
    2.3ApplicationSapEpbc2********7.007.02
  • OR - Configuration 3
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSapKmc-bc7.30*******
    2.3ApplicationSapKmc-bc7.31*******
    2.3ApplicationSapKmc-bc7.40*******
    2.3ApplicationSapKmc-bc7.50*******

Vulnerable Software List

VendorProductVersions
Sap Netweaver Knowledge Management Configuration Service -
Sap Epbc *
Sap Epbc2 *
Sap Kmc-bc 7.30, 7.31, 7.40, 7.50

References

NameSourceURLTags
102149http://www.securityfocus.com/bid/102149BIDThird Party Advisory VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/CONFIRMVendor Advisory
https://launchpad.support.sap.com/#/notes/2457562https://launchpad.support.sap.com/#/notes/2457562CONFIRMPermissions Required