PT-2021-20280 · Sap · Sap Business One

Published 2021-09-15 · Updated 2021-09-28 · CVE-2021-33704

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP Business One version 10.0

Description: The Service Layer of SAP Business One allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. No in-depth system knowledge is required for an attacker to discover the vulnerable function. Once exploited via the Network stack, the attacker may be able to read, modify, or delete restricted data. The impact is that missing authorization can result in the abuse of functionality usually restricted to specific users.

Recommendations: For SAP Business One version 10.0, consider restricting access to the vulnerable functions until a patch is available. As a temporary workaround, limit the invocation of restricted functions to authorized users only. Additionally, monitor network stack activity for potential exploitation attempts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-33704

Affected Products

Sap Business One

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-33704 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33704 · Vendor Advisory
• https://t.me/cvenotify/21562 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3078072 · Note
• https://t.me/cvenotify/20910 · Telegram Post
• https://t.me/cvenotify/20930 · Telegram Post
• https://t.me/cibsecurity/28948 · Telegram Post