CVE-2017-16684: vulnerability in SAP Business Intelligence Promotion Management…
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The SAP Business Intelligence Promotion Management Application skips authentication checks, allowing anyone to access restricted features without proving who they are. This is serious because sensitive business data and operations can be accessed by unauthorized users.
The application fails to implement authentication verification for certain functionalities across versions 4.10, 4.20, and 4.30, enabling unauthenticated access to protected operations. An attacker can directly invoke privileged functions without valid credentials, potentially leading to unauthorized data disclosure, manipulation, or system compromise.