PT-2021-21977 · Sap · Sap Appl+4

Published 2021-09-14 · Updated 2021-09-24 · CVE-2021-38164

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SAP ERP Financial Accounting (RFOPENPOSTING FR) versions - SAP APPL - 600, 602, 603, 604, 605, 606, 616, SAP FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105

Description: The issue allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited, the attacker may be able to view and modify financial accounting data that only a specific user should have access to.

Recommendations: For SAP APPL versions 600, 602, 603, 604, 605, 606, 616, consider restricting access to the affected functions until a patch is available. For SAP FIN versions 617, 618, 700, 720, 730, restrict access to the vulnerable functions to minimize the risk of exploitation. For SAPSCORE version 125, and S4CORE versions 100, 101, 102, 103, 104, 105, consider disabling the exposed functions over the network as a temporary workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-38164

Affected Products

S4Core

Sap Erp Financial Accounting

Sapscore

Sap Appl

Sap Fin

References · 5

• https://osv.dev/vulnerability/CVE-2021-38164 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38164 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3068582 · Note
• https://t.me/cibsecurity/28804 · Telegram Post