CVE-2021-27609

SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without the intended authorization.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3030948	Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649	Vendor Advisory
https://launchpad.support.sap.com/#/notes/3030948	Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:focused_run:200:::::::*
	cpe:2.3:a:sap:focused_run:300:::::::*

History

21 Nov 2024, 05:58

Type	Values Removed	Values Added
References	~~() https://launchpad.support.sap.com/#/notes/3030948 - Permissions Required~~	() https://launchpad.support.sap.com/#/notes/3030948 - Permissions Required
References	~~() https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - Vendor Advisory~~	() https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - Vendor Advisory

Information

Published : 2021-04-13 19:15

Updated : 2024-11-21 05:58

NVD link : CVE-2021-27609

Mitre link : CVE-2021-27609

CVE.ORG link : CVE-2021-27609

JSON object : View

Products Affected

sap

focused_run

CWE

CWE-862

Missing Authorization

{"id": "CVE-2021-27609", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.1}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-04-13T19:15:15.537", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3030948", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/3030948", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without the intended authorization."}, {"lang": "es", "value": "SAP Focused RUN versiones 200, 300 no llevan a cabo las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, el cual permite a un usuario llamar al servicio oData y manipular la activaci\u00f3n para la recopilaci\u00f3n y env\u00edo de datos del servicio SAP EarlyWatch Alert a SAP sin la autorizaci\u00f3n prevista"}], "lastModified": "2024-11-21T05:58:17.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:focused_run:200:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23D18964-F53B-426A-A65B-C47A407992E1"}, {"criteria": "cpe:2.3:a:sap:focused_run:300:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18EAA789-3AAE-4C69-88B6-F457247A19D8"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}