Open redirect in SAP Startup Service
Priority LOW 29CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-601.
Summary
URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that allows an attacker to redirect users to a malicious site.
Why it matters now
EPSS 0.00867 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Startup Service | SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52. | — | No fix listed | CNA |
- SAP Startup Service VendorSAP Affected SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52. Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sap:sap_kernel:7.21:*:*:*:*:*:*:* | 7.21 | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.21ext:*:*:*:*:*:*:* | 7.21ext | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.22:*:*:*:*:*:*:* | 7.22 | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.45:*:*:*:*:*:*:* | 7.45 | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.49:*:*:*:*:*:*:* | 7.49 | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.52:*:*:*:*:*:*:* | 7.52 | Vulnerable | SAP |
- cpe:2.3:o:sap:sap_kernel:7.21:*:*:*:*:*:*:* Versions 7.21 Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.21ext:*:*:*:*:*:*:* Versions 7.21ext Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.45:*:*:*:*:*:*:* Versions 7.45 Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.52:*:*:*:*:*:*:* Versions 7.52 Vulnerable ·SAP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-16679
- 2026-10-03 Alias added: GHSA-757w-wphr-p72r
References
More Sap Kernel vulnerabilities
- TI-2017-12277 Improper authentication in SAP Trusted RFC connection CVSS 3.0HIGH 8.8
- TI-2018-01748 Missing authentication in SAP Startup Service CVSS 3.0HIGH 7.5
- TI-2019-00299 SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22… CVSS 3.1HIGH 7.5
- TI-2017-03910 The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to… CVSS 3.0HIGH 7.5
- TI-2018-01815 SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64… CVSS 3.0HIGH 7.5
- TI-2014-07786 Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2017-16679 · CVE Program
- CVE-2017-16679 · NVD
- FIRST EPSS
- GHSA-757w-wphr-p72r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences