CVE-2017-16680

Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input validation which could allow unprivileged attackers to forge audit log lines. Hence the interpretation of audit log files could be hindered or misdirected. 2) User Account and Authentication writes audit logs into syslog and additionally writes the same audit entries into a log file. Entries in the log file miss escaping. Hence the interpretation of audit log files could be hindered or misdirected, while the entries in syslog are correct.

• CWE-74

• http://www.securityfocus.com/bid/102138Third Party Advisory, VDB Entry
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2522510Permissions Required, Vendor Advisory
• http://www.securityfocus.com/bid/102138Third Party Advisory, VDB Entry
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2522510Permissions Required, Vendor Advisory

Published

Dec 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16672An issue was discovered in Asterisk Open Source 13 before 13…
• CVE-2017-16673Datto Backup Agent 1.0.6.0 and earlier does not authenticate…
• CVE-2017-16674Datto Windows Agent allows unauthenticated remote command ex…
• CVE-2017-16678Server Side Request Forgery (SSRF) vulnerability in SAP NetW…
• CVE-2017-16679URL redirection vulnerability in SAP's Startup Service, SAP …
• CVE-2017-1668IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could all…
• CVE-2017-16681Cross-Site Scripting (XSS) vulnerability in SAP Business Int…
• CVE-2017-16682SAP NetWeaver Internet Transaction Server (ITS), SAP Basis f…
• CVE-2017-16683Denial of Service (DOS) in SAP Business Objects Platform, En…
• CVE-2017-16684SAP Business Intelligence Promotion Management Application, …
• CVE-2017-16685Cross-Site scripting (XSS) in SAP Business Warehouse Univers…
• CVE-2017-16687The user self-service tools of SAP HANA extended application…