CVE-2017-16687

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be misused to enumerate valid and invalid user accounts. An unauthenticated user could use the error messages to determine if a given username is valid.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
SAP	SAP HANA extended application services	SAP HANA Database 1.00, 2.00

References

http://www.securityfocus.com/bid/102152Third Party Advisory, VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2549983Permissions Required, Vendor Advisory
http://www.securityfocus.com/bid/102152Third Party Advisory, VDB Entry
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
https://launchpad.support.sap.com/#/notes/2549983Permissions Required, Vendor Advisory

Timeline

Published: Dec 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166898.8A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP CVE-2017-16693.7IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure i CVE-2017-166907.8A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It i CVE-2017-166916.5SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally si CVE-2017-16709.8IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statem CVE-2017-167097.2Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated admini CVE-2017-16717.5IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could se CVE-2017-167104.8Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware bef CVE-2017-167115.5The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remo CVE-2017-167149.8In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without CVE-2017-167158.6An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Vers CVE-2017-167169.8A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands.