PT-2021-14553 · Sap · Sap Payment Engine

Published 2021-03-09 · Updated 2021-03-16 · CVE-2021-21487

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Payment Engine version 500

Description The issue is related to the lack of necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Recommendations For SAP Payment Engine version 500, apply the necessary patches or updates to include proper authorization checks for authenticated users.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-21487

Affected Products

Sap Payment Engine

References · 6

• https://launchpad.support.sap.com/#/notes/3023778 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21487 · Security Note
• https://t.me/cibsecurity/24613 · Telegram Post
• https://t.me/cvenotify/11457 · Telegram Post