CVE-2021-42062

SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3104456	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:erp_human_capital_management:600::::portugal:::
	cpe:2.3:a:sap:erp_human_capital_management:604::::portugal:::
	cpe:2.3:a:sap:erp_human_capital_management:608::::portugal:::

History

No history.

Information

Published : 2021-11-10 16:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-42062

Mitre link : CVE-2021-42062

CVE.ORG link : CVE-2021-42062

JSON object : View

Products Affected

sap

erp_human_capital_management

CWE

CWE-862

Missing Authorization

{"id": "CVE-2021-42062", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2021-11-10T16:15:09.277", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3104456", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts."}, {"lang": "es", "value": "SAP ERP HCM Portugal no lleva a cabo las comprobaciones de autorizaci\u00f3n necesarias para un informe que lee los datos de las n\u00f3minas de los empleados de un \u00e1rea determinada. Como el informe afectado s\u00f3lo lee la informaci\u00f3n de la n\u00f3mina, el atacante no puede modificar ninguna informaci\u00f3n ni causar impactos de disponibilidad"}], "lastModified": "2021-11-15T14:50:29.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:erp_human_capital_management:600:*:*:*:portugal:*:*:*", "vulnerable": true, "matchCriteriaId": "C80ACC56-A755-4491-A9FF-D8A806EE4F33"}, {"criteria": "cpe:2.3:a:sap:erp_human_capital_management:604:*:*:*:portugal:*:*:*", "vulnerable": true, "matchCriteriaId": "FD6309CF-9A86-4F35-A29B-C7ACE2051126"}, {"criteria": "cpe:2.3:a:sap:erp_human_capital_management:608:*:*:*:portugal:*:*:*", "vulnerable": true, "matchCriteriaId": "1479D860-4064-438D-AC48-90E67B2C41C7"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}