CVE-2017-14511

An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and confirm email addresses that they do not have access to (candidate_hrobject is predictable and corr_act_guid is improperly validated). Furthermore, since an email address can be registered only once, an attacker could prevent other legitimate users from registering. This is SAP Security Note 2507798.

• CWE-20

• https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2507798Permissions Required, Vendor Advisory
• https://www.sec-consult.com/en/blog/advisories/email-verification-bypass-in-sap-e-recruiting/index.htmlThird Party Advisory
• https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2507798Permissions Required, Vendor Advisory
• https://www.sec-consult.com/en/blog/advisories/email-verification-bypass-in-sap-e-recruiting/index.htmlThird Party Advisory

Published

Sep 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demon…5.4
• CVE-2017-14507Multiple SQL injection vulnerabilities in the Content Timeli…
• CVE-2017-14508An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-14509An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-1451IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.…
• CVE-2017-14510An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-14512NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage…
• CVE-2017-14513Directory traversal vulnerability in MetInfo 5.3.17 allows r…
• CVE-2017-14514Directory Traversal on Tenda W15E devices before 15.11.0.14 …
• CVE-2017-14515Heap-based Buffer Overflow on Tenda W15E devices before 15.1…
• CVE-2017-14516Cross-Site Scripting (XSS) exists in SAP Business Objects Fi…
• CVE-2017-14517In Poppler 0.59.0, a NULL Pointer Dereference exists in the …