PT-2021-17534 · Sap · Sap Netweaver As Java

Published 2021-04-13 · Updated 2022-10-07 · CVE-2021-27598

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA versions 7.31, 7.40, 7.50

Description The issue allows an attacker to read statistical data, including product version, traffic, and timestamp, due to a missing authorization check in the Customer Usage Provisioning Servlet.

Recommendations For versions 7.31, 7.40, 7.50, consider restricting access to the Customer Usage Provisioning Servlet until a patch is available. As a temporary workaround, consider implementing additional authorization checks for the servlet to minimize the risk of exploitation.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2021-27598

Affected Products

Sap Netweaver As Java

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27598 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27598 · Vendor Advisory
• https://t.me/cvenotify/13176 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3027937 · Note