PT-2021-22904 · Sap · Sap Successfactors Mobile Application

Published 2021-10-12 · Updated 2021-10-18 · CVE-2021-40498

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP SuccessFactors Mobile Application for Android versions older than 2108

Description A vulnerability has been identified that allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The issue is related to Android implementation methods widely used across Android mobile applications, which are embedded into the SAP SuccessFactors mobile application. These methods start executing when a user accesses their profile on the mobile application and can also pick up activities from other Android applications running in the background that use the same methods. This vulnerability can also lead to phishing attacks used for staging other types of attacks.

Recommendations For versions older than 2108, update to version 2108 or later to resolve the issue. As a temporary workaround, consider restricting access to the SAP SuccessFactors mobile application until a patch is applied. Additionally, be cautious of phishing attacks that may exploit this vulnerability, and ensure that all users are aware of the potential risks associated with accessing their profiles on the mobile application.

Fix

Related Identifiers

CVE-2021-40498

Affected Products

Sap Successfactors Mobile Application

References · 5

• https://osv.dev/vulnerability/CVE-2021-40498 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40498 · Security Note
• https://launchpad.support.sap.com/#/notes/3077635 · Note
• https://t.me/cibsecurity/30408 · Telegram Post