Lucene search

SapCVELIST:CVE-2021-27608

HistoryApr 14, 2021 - 2:23 p.m.

CVE-2021-27608

2021-04-1414:23:21

sap

www.cve.org

sapsetup unquoted service path

privilege escalation

cve-2021-27608

confidentiality

integrity

availability

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

12.6%

JSON

An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable file is registered. This could further lead to complete compromise of confidentiality, Integrity and Availability.

CNA Affected

[
  {
    "product": "SAP Setup",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 9.0"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3039649

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVELIST:CVE-2021-27608