PT-2021-6148 · Sap · Sap Business One

Published 2021-08-13 · Updated 2021-09-28 · CVE-2021-33698

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business One version 10.0

Description The issue is related to a lack of restrictions on file uploads in the system, allowing a remote attacker to upload and execute arbitrary files. This can be done by an attacker with business authorization, who can upload any files, including script files, without proper file format validation.

Recommendations For SAP Business One version 10.0, consider restricting file upload capabilities to authorized personnel and validating file formats before allowing uploads to prevent exploitation. As a temporary workaround, consider disabling file upload functionality until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-01024

CVE-2021-33698

Affected Products

Sap Business One

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-33698 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01024 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33698 · Vendor Advisory
• https://t.me/isacarusec/4329 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3071984 · Note
• https://t.me/cibsecurity/28952 · Telegram Post
• https://t.me/cvenotify/20917 · Telegram Post
• https://t.me/true_secator/2000 · Telegram Post