PT-2021-17545 · Sap · Sap Earlywatch Alert+1

Published 2021-04-13 · Updated 2021-04-20 · CVE-2021-27609

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Focused RUN versions 200, 300

Description The issue concerns a lack of necessary authorization checks for authenticated users, allowing them to manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without proper authorization. This can be achieved by calling the oData service.

Recommendations For SAP Focused RUN versions 200, 300, consider restricting access to the oData service until a fix is available to prevent unauthorized manipulation of the SAP EarlyWatch Alert service.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-27609

Affected Products

Sap Earlywatch Alert

Sap Focused Run

References · 4

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27609 · Security Note
• https://launchpad.support.sap.com/#/notes/3030948 · Note