Buffer overflow in SAP Sapcar
CVE-2017-8852
SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source. The problem is that the length of data written is an arbitrary number found within the file. The vendor response is SAP Security Note 2441560.
Vulnerability class: Buffer Overflow
EPSS: 0.033 (87.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Sap Sapcar — versions 721.510
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2017-8852?
- CVE-2017-8852 is a high-severity vulnerability in SAP Sapcar, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2017-05-10.
- How severe is CVE-2017-8852?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2017-8852 known to be exploited?
- 34 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.