SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3087254 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Oct 2022, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap netweaver Application Server Abap
|
|
| CPE | cpe:2.3:a:sap:netweaver_as_abap:701:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:702:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:700:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:753:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:731:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:756:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:754:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:750:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:740:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:785:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:752:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:755:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:751:*:*:*:*:*:*:* |
cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:785:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* |
28 Nov 2021, 23:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3087254 - Permissions Required, Vendor Advisory |
19 Oct 2021, 00:28
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3087254 - Permissions Required | |
| CWE | CWE-668 | |
| CPE | cpe:2.3:a:sap:netweaver_as_abap:753:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:731:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:750:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:701:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:702:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:730:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:752:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:756:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:700:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:754:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:740:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:751:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:785:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:785:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap:755:*:*:*:*:*:*:* |
12 Oct 2021, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-12 15:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-40496
Mitre link : CVE-2021-40496
CVE.ORG link : CVE-2021-40496
JSON object : View
Products Affected
sap
- netweaver_abap
- netweaver_application_server_abap
CWE
CWE-668
Exposure of Resource to Wrong Sphere