{"cve":"CVE-2017-16691","nvd":{"published":"2017-12-12T14:29:00.700","modified":"2026-06-17T01:09:40.857","status":"Modified","description":"SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-20"],"references":["http://www.securityfocus.com/bid/101822","https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/","https://launchpad.support.sap.com/#/notes/2546220","http://www.securityfocus.com/bid/101822","https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"],"products":["sap:business_application_software_integrated_solution"],"source":"nvd","synced_at":"2026-10-19T20:47:56.471723566+00:00"},"epss":{"cve":"CVE-2017-16691","score":0.01254,"percentile":0.6949,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}