{"cve":"CVE-2017-14511","nvd":{"published":"2017-09-17T21:29:00.373","modified":"2026-06-17T01:06:17.483","status":"Modified","description":"An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and confirm email addresses that they do not have access to (candidate_hrobject is predictable and corr_act_guid is improperly validated). Furthermore, since an email address can be registered only once, an attacker could prevent other legitimate users from registering. This is SAP Security Note 2507798.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-20"],"references":["https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/","https://launchpad.support.sap.com/#/notes/2507798","https://www.sec-consult.com/en/blog/advisories/email-verification-bypass-in-sap-e-recruiting/index.html","https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/","https://launchpad.support.sap.com/#/notes/2507798"],"products":["sap:e-recruiting"],"source":"nvd","synced_at":"2026-10-19T20:46:01.145313090+00:00"},"epss":{"cve":"CVE-2017-14511","score":0.01408,"percentile":0.72635,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}