High severity · published Nov 10, 2021
CVE-2021-40501
SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of…
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Abap Platform Kernel · Sap
7.77; 7.81; 7.85; 7.86 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40501
Permissions Required
https://launchpad.support.sap.com/#/notes/3099776
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864
More from Abap Platform Kernel
5.3
CVE-2023-29108
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling