Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

SAP SSO Library can exhaust memory with large QR request

CVE-2017-7696 · published 9 years ago
Summary

The SAP SSO Authentication Library (versions 2.0 to 3.0) can be triggered by a remote user sending unusually large width or height values in a QR‑code request. This makes the system use excessive memory, which can slow down or stop the service. Apply the vendor's security update or upgrade to a newer version to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap sso_authentication_library 2.0
3.0
cpe:2.3:a:sap:sso_authentication_library:2.0:*:*:*:*:*:*:*
Original advisory text
SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_r...
SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_resources/qr, aka SAP Security Note 2389042.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
36% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published14 Apr 2017
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2017-7696 · NVD
Track software like this
Free during beta