Vulnerability · Published May 11, 2021 · Assigned by sap

CVE-2021-27616

High 7.8

In plain English

A high-severity security flaw in SAP Business One, version for SAP HANA (Cookbooks) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.0)7.8High

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted, resulting in Information Disclosure vulnerability highly impacting the confidentiality, integrity and availability of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP Business One, version for SAP HANA (Cookbooks)	< 8.82< 9.0< 9.1< 9.2< 9.3< 10.0

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3049661 x_refsource_MISC