CVE-2021-40501

2021-11-1015:22:15

CWE-862

sap

www.cve.org

sap

abap

platform kernel

authorization

vulnerability

privileges

escalation

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.

CNA Affected

[
  {
    "product": "SAP ABAP Platform Kernel",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.77"
      },
      {
        "status": "affected",
        "version": "< 7.81"
      },
      {
        "status": "affected",
        "version": "< 7.85"
      },
      {
        "status": "affected",
        "version": "< 7.86"
      }
    ]
  }
]