Vulnerability · Published Nov 10, 2021 · Assigned by sap
CVE-2021-40501
High 8.1
In plain English
A high-severity missing authorization in SAP ABAP Platform Kernel from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP ABAP Platform Kernel | < 7.77< 7.81< 7.85< 7.86 |
Weakness: CWE-862
References
- https://launchpad.support.sap.com/#/notes/3099776 x_refsource_MISC
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864 x_refsource_MISC