CVE-2017-16678

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
SAP	SAP NetWeaver Knowledge Management Configuration Service	EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50

References

http://www.securityfocus.com/bid/102149Third Party Advisory, VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2457562Permissions Required
http://www.securityfocus.com/bid/102149Third Party Advisory, VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2457562Permissions Required

Timeline

Published: Dec 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166796.1URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7 CVE-2017-16686.1IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.CVE-2017-166807.5Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controll CVE-2017-166816.1Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user CVE-2017-166827.2SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with a CVE-2017-166836.5Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users CVE-2017-166849.8SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for func CVE-2017-166856.1Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to ins CVE-2017-166875.3The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 CVE-2017-166898.8A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP CVE-2017-16693.7IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure i CVE-2017-166907.8A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It i