Lucene search

[email protected]CVE-2021-38164

HistorySep 14, 2021 - 12:15 p.m.

CVE-2021-38164

2021-09-1412:15:10

CWE-862

[email protected]

web.nvd.nist.gov

cve-2021-38164

sap erp

financial accounting

unauthorized access

security vulnerability

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.8%

JSON

SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.

Affected configurations

NVD

Node

saperp_financial_accountingMatch100

saperp_financial_accountingMatch101

saperp_financial_accountingMatch102

saperp_financial_accountingMatch103

saperp_financial_accountingMatch104

saperp_financial_accountingMatch105

saperp_financial_accountingMatch602

saperp_financial_accountingMatch603

saperp_financial_accountingMatch604

saperp_financial_accountingMatch605

saperp_financial_accountingMatch606

saperp_financial_accountingMatch616

saperp_financial_accountingMatch618

saperp_financial_accountingMatch700

saperp_financial_accountingMatch720

saperp_financial_accountingMatch730

saperp_financial_accountingMatchs4core

saperp_financial_accountingMatchsap_appl_-_600

saperp_financial_accountingMatchsap_fin_-_617

saperp_financial_accountingMatchsapscore_-_125

CPENameOperatorVersion
sap:erp_financial_accountingsap erp financial accountingeq100
sap:erp_financial_accountingsap erp financial accountingeq101
sap:erp_financial_accountingsap erp financial accountingeq102
sap:erp_financial_accountingsap erp financial accountingeq103
sap:erp_financial_accountingsap erp financial accountingeq104
sap:erp_financial_accountingsap erp financial accountingeq105
sap:erp_financial_accountingsap erp financial accountingeq602
sap:erp_financial_accountingsap erp financial accountingeq603
sap:erp_financial_accountingsap erp financial accountingeq604
sap:erp_financial_accountingsap erp financial accountingeq605

CPE	Name	Operator	Version
sap:erp_financial_accounting	sap erp financial accounting	eq	100
sap:erp_financial_accounting	sap erp financial accounting	eq	101
sap:erp_financial_accounting	sap erp financial accounting	eq	102
sap:erp_financial_accounting	sap erp financial accounting	eq	103
sap:erp_financial_accounting	sap erp financial accounting	eq	104
sap:erp_financial_accounting	sap erp financial accounting	eq	105
sap:erp_financial_accounting	sap erp financial accounting	eq	602
sap:erp_financial_accounting	sap erp financial accounting	eq	603
sap:erp_financial_accounting	sap erp financial accounting	eq	604
sap:erp_financial_accounting	sap erp financial accounting	eq	605

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "SAP ERP Financial Accounting (RFOPENPOSTING_FR)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< SAP_APPL - 600"
      },
      {
        "status": "affected",
        "version": "< 602"
      },
      {
        "status": "affected",
        "version": "< 603"
      },
      {
        "status": "affected",
        "version": "< 604"
      },
      {
        "status": "affected",
        "version": "< 605"
      },
      {
        "status": "affected",
        "version": "< 606"
      },
      {
        "status": "affected",
        "version": "< 616"
      },
      {
        "status": "affected",
        "version": "< SAP_FIN - 617"
      },
      {
        "status": "affected",
        "version": "< 618"
      },
      {
        "status": "affected",
        "version": "< 700"
      },
      {
        "status": "affected",
        "version": "< 720"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< SAPSCORE - 125"
      },
      {
        "status": "affected",
        "version": "< S4CORE"
      },
      {
        "status": "affected",
        "version": "< 100"
      },
      {
        "status": "affected",
        "version": "< 101"
      },
      {
        "status": "affected",
        "version": "< 102"
      },
      {
        "status": "affected",
        "version": "< 103"
      },
      {
        "status": "affected",
        "version": "< 104"
      },
      {
        "status": "affected",
        "version": "< 105"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3068582

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.8%

JSON

Related for CVE-2021-38164

prion1 cvelist1 nvd1