SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3099776 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Nov 2021, 20:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864 - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3099776 - Permissions Required, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.5
v3 : 8.1 |
| CPE | cpe:2.3:a:sap:abap_platform_kernel:7.85:*:*:*:*:*:*:* cpe:2.3:a:sap:abap_platform_kernel:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:abap_platform_kernel:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:abap_platform_kernel:7.86:*:*:*:*:*:*:* |
10 Nov 2021, 16:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-11-10 16:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-40501
Mitre link : CVE-2021-40501
CVE.ORG link : CVE-2021-40501
JSON object : View
Products Affected
sap
- abap_platform_kernel
CWE
CWE-862
Missing Authorization