PT-2021-14552 · Sap · Sap Enterprise Financial Services

Published 2021-03-09 · Updated 2021-03-16 · CVE-2021-21486

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Enterprise Financial Services versions 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800

Description The issue results from the software not performing necessary authorization checks for an authenticated user, leading to escalation of privileges.

Recommendations For SAP Enterprise Financial Services versions 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, update to a version that includes the necessary authorization checks to prevent escalation of privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-21486

Affected Products

Sap Enterprise Financial Services

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-21486 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21486 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3007888 · Vendor Advisory
• https://t.me/cvenotify/11452 · Telegram Post
• https://t.me/cibsecurity/24604 · Telegram Post