CVE-2017-16685

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding of user controlled inputs.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP	SAP Business Warehouse Universal Data Integration	BI UDI from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50

References

http://www.securityfocus.com/bid/102148Third Party Advisory, VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2537545Permissions Required
http://www.securityfocus.com/bid/102148Third Party Advisory, VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2537545Permissions Required

Timeline

Published: Dec 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166875.3The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 CVE-2017-166898.8A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP CVE-2017-16693.7IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure i CVE-2017-166907.8A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It i CVE-2017-166916.5SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally si CVE-2017-16709.8IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statem CVE-2017-167097.2Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated admini CVE-2017-16717.5IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could se CVE-2017-167104.8Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware bef CVE-2017-167115.5The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remo CVE-2017-167149.8In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without CVE-2017-167158.6An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Vers