CVE-2017-16691

SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.

• CWE-20

• http://www.securityfocus.com/bid/101822Third Party Advisory, VDB Entry
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2546220Permissions Required, Vendor Advisory
• http://www.securityfocus.com/bid/101822Third Party Advisory, VDB Entry
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2546220Permissions Required, Vendor Advisory

Published

Dec 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16684SAP Business Intelligence Promotion Management Application, …
• CVE-2017-16685Cross-Site scripting (XSS) in SAP Business Warehouse Univers…
• CVE-2017-16687The user self-service tools of SAP HANA extended application…
• CVE-2017-16689A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32U…
• CVE-2017-1669IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores se…
• CVE-2017-16690A malicious DLL preload attack possible on NwSapSetup and In…
• CVE-2017-1670IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulner…
• CVE-2017-16709Crestron Airmedia AM-100 devices with firmware before 1.6.0 …
• CVE-2017-1671IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could all…
• CVE-2017-16710Cross-site scripting (XSS) vulnerability in Crestron Airmedi…
• CVE-2017-16711The swf_DefineLosslessBitsTagToImage function in lib/modules…
• CVE-2017-16714In Ice Qube Thermal Management Center versions prior to vers…