by Kastro
Paper/Archive/CVE-2021-27610

CVE-2021-27610

SAP SE SAP NetWeaver AS ABAP and ABAP Platform — SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create infor…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.9.709 × 2014.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system.

Affected

ProductAffectedFixed inSource
SAP NetWeaver AS ABAP and ABAP Platform< 700–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 701–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 702–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 731–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 740–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 750–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 751–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 752–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 753–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 754–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 755–CNA
SAP NetWeaver AS ABAP and ABAP Platform< 804–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)9.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999reflaunchpad.support.sap.com/#/notes/3007182