Vulnerability · Published Jun 9, 2021 · Assigned by sap
CVE-2021-21473
Medium 6.3
In plain English
A medium-severity security flaw in SAP NetWeaver AS ABAP and ABAP Platform (SRM_RFC_SUBMIT_REPORT) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.0)6.3Medium
Exploit odds (30 days)1.2%top 30.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver AS ABAP and ABAP Platform (SRM_RFC_SUBMIT_REPORT) | < 700< 702< 710< 711< 730< 731< 740< 750 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3002517 x_refsource_MISC
- 20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components) mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html x_refsource_MISC