Lucene search

SapCVELIST:CVE-2021-27613

HistoryMay 11, 2021 - 2:19 p.m.

CVE-2021-27613

2021-05-1114:19:33

sap

www.cve.org

sap business one

chef cookbook

insecure temp folder

information disclosure

system confidentiality

system integrity

system availability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

12.6%

JSON

Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information which would otherwise be restricted, which could lead to Information Disclosure and highly impact system confidentiality, integrity and availability.

CNA Affected

[
  {
    "product": "SAP Business One (Cookbooks)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 9.2"
      },
      {
        "status": "affected",
        "version": "< 9.3"
      },
      {
        "status": "affected",
        "version": "< 10.0"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3049755

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVELIST:CVE-2021-27613