CVE-2017-7717

moderate-risk

Published 2017-04-14

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504.

Do I need to act?

0.84% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (1)

Netweaver Application Server Java

Affected Vendors

Sap

References (6)

Third Party Advisory http://www.securityfocus.com/bid/100168

Third Party Advisory http://www.securityfocus.com/bid/95364

Third Party Advisory https://erpscan.io/advisories/erpscan-17-003-sap-netweaver-7-4-getuseruddielemen...

Third Party Advisory http://www.securityfocus.com/bid/100168

Third Party Advisory http://www.securityfocus.com/bid/95364

Third Party Advisory https://erpscan.io/advisories/erpscan-17-003-sap-netweaver-7-4-getuseruddielemen...

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 3/34 · Minimal

Exposure 5/34 · Minimal