CVE-2017-16679

URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that allows an attacker to redirect users to a malicious site.

• CWE-601

• http://www.securityfocus.com/bid/102157Third Party Advisory, VDB Entry
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2520995Permissions Required, Vendor Advisory
• http://www.securityfocus.com/bid/102157Third Party Advisory, VDB Entry
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2520995Permissions Required, Vendor Advisory

Published

Dec 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16670The project import functionality in SoapUI 5.3.0 allows remo…
• CVE-2017-16671A Buffer Overflow issue was discovered in Asterisk Open Sour…
• CVE-2017-16672An issue was discovered in Asterisk Open Source 13 before 13…
• CVE-2017-16673Datto Backup Agent 1.0.6.0 and earlier does not authenticate…
• CVE-2017-16674Datto Windows Agent allows unauthenticated remote command ex…
• CVE-2017-16678Server Side Request Forgery (SSRF) vulnerability in SAP NetW…
• CVE-2017-1668IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could all…
• CVE-2017-16680Two potential audit log injections in SAP HANA extended appl…
• CVE-2017-16681Cross-Site Scripting (XSS) vulnerability in SAP Business Int…
• CVE-2017-16682SAP NetWeaver Internet Transaction Server (ITS), SAP Basis f…
• CVE-2017-16683Denial of Service (DOS) in SAP Business Objects Platform, En…
• CVE-2017-16684SAP Business Intelligence Promotion Management Application, …