Lucene search

[email protected]CVE-2021-21473

HistoryJun 09, 2021 - 2:15 p.m.

CVE-2021-21473

2021-06-0914:15:07

CWE-862

[email protected]

web.nvd.nist.gov

sap

netweaver

abap

versions

700

702

710

711

730

731

740

750

751

752

753

754

755

function module

srm_rfc_submit_report

authorization

user

report execution

nvd

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

7 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.6%

JSON

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.

Affected configurations

NVD

Node

sapnetweaver_application_server_abapMatch700

sapnetweaver_application_server_abapMatch702

sapnetweaver_application_server_abapMatch710

sapnetweaver_application_server_abapMatch711

sapnetweaver_application_server_abapMatch730

sapnetweaver_application_server_abapMatch731

sapnetweaver_application_server_abapMatch740

sapnetweaver_application_server_abapMatch750

sapnetweaver_application_server_abapMatch751

sapnetweaver_application_server_abapMatch752

sapnetweaver_application_server_abapMatch753

sapnetweaver_application_server_abapMatch754

sapnetweaver_application_server_abapMatch755

CPENameOperatorVersion
sap:netweaver_application_server_abapsap netweaver application server abapeq700
sap:netweaver_application_server_abapsap netweaver application server abapeq702
sap:netweaver_application_server_abapsap netweaver application server abapeq710
sap:netweaver_application_server_abapsap netweaver application server abapeq711
sap:netweaver_application_server_abapsap netweaver application server abapeq730
sap:netweaver_application_server_abapsap netweaver application server abapeq731
sap:netweaver_application_server_abapsap netweaver application server abapeq740
sap:netweaver_application_server_abapsap netweaver application server abapeq750
sap:netweaver_application_server_abapsap netweaver application server abapeq751
sap:netweaver_application_server_abapsap netweaver application server abapeq752

CPE	Name	Operator	Version
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	700
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	702
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	710
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	711
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	730
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	731
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	740
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	750
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	751
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	752

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "product": "SAP NetWeaver AS ABAP and ABAP Platform (SRM_RFC_SUBMIT_REPORT)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 700"
      },
      {
        "status": "affected",
        "version": "< 702"
      },
      {
        "status": "affected",
        "version": "< 710"
      },
      {
        "status": "affected",
        "version": "< 711"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< 731"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      },
      {
        "status": "affected",
        "version": "< 751"
      },
      {
        "status": "affected",
        "version": "< 752"
      },
      {
        "status": "affected",
        "version": "< 753"
      },
      {
        "status": "affected",
        "version": "< 754"
      },
      {
        "status": "affected",
        "version": "< 755"
      }
    ]
  }
]

References

packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

seclists.org/fulldisclosure/2022/May/42

launchpad.support.sap.com/#/notes/3002517

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

Social References

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

7 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.6%

JSON

Related for CVE-2021-21473

nvd1 prion1 nessus1 cvelist1 packetstorm1