cnvd - cnvd-2021-18017

CNVD-2021-18017

Vulnerability from cnvd - Published: 2021-03-16

Title

SAP Enterprise Financial Services权限提升漏洞（CNVD-2021-18017）

Description

SAP Enterprise Financial Services是德国思爱普（SAP）公司的一套企业财务服务解决方案。 SAP Enterprise Financial Services 101、102、103、104、105、600、603、604、605、606、616、617、618、800版本存在安全漏洞，该漏洞源于程序未对经过身份认证的用户执行正确的授权检查。攻击者可利用该漏洞提升权限。

Severity

中

Patch Name

SAP Enterprise Financial Services权限提升漏洞（CNVD-2021-18017）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://launchpad.support.sap.com/#/notes/3007888

Reference

https://vigilance.fr/vulnerability/SAP-multiple-vulnerabilities-of-March-2021-34786

Impacted products

Name
['SAP Enterprise Financial Services 101', 'SAP Enterprise Financial Services 102', 'SAP Enterprise Financial Services 103', 'SAP Enterprise Financial Services 104', 'SAP Enterprise Financial Services 105', 'SAP Enterprise Financial Services 600', 'SAP Enterprise Financial Services 603', 'SAP Enterprise Financial Services 604', 'SAP Enterprise Financial Services 605', 'SAP Enterprise Financial Services 606', 'SAP Enterprise Financial Services 616', 'SAP Enterprise Financial Services 617', 'SAP Enterprise Financial Services 618', 'SAP Enterprise Financial Services 800']

Name

['SAP Enterprise Financial Services 101', 'SAP Enterprise Financial Services 102', 'SAP Enterprise Financial Services 103', 'SAP Enterprise Financial Services 104', 'SAP Enterprise Financial Services 105', 'SAP Enterprise Financial Services 600', 'SAP Enterprise Financial Services 603', 'SAP Enterprise Financial Services 604', 'SAP Enterprise Financial Services 605', 'SAP Enterprise Financial Services 606', 'SAP Enterprise Financial Services 616', 'SAP Enterprise Financial Services 617', 'SAP Enterprise Financial Services 618', 'SAP Enterprise Financial Services 800']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-21486",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-21486"
    }
  },
  "description": "SAP Enterprise Financial Services\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u4f01\u4e1a\u8d22\u52a1\u670d\u52a1\u89e3\u51b3\u65b9\u6848\u3002\n\nSAP Enterprise Financial Services 101\u3001102\u3001103\u3001104\u3001105\u3001600\u3001603\u3001604\u3001605\u3001606\u3001616\u3001617\u3001618\u3001800\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5bf9\u7ecf\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u7684\u7528\u6237\u6267\u884c\u6b63\u786e\u7684\u6388\u6743\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u5347\u6743\u9650\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1ahttps://launchpad.support.sap.com/#/notes/3007888",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-18017",
  "openTime": "2021-03-16",
  "patchDescription": "SAP Enterprise Financial Services\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u4f01\u4e1a\u8d22\u52a1\u670d\u52a1\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nSAP Enterprise Financial Services 101\u3001102\u3001103\u3001104\u3001105\u3001600\u3001603\u3001604\u3001605\u3001606\u3001616\u3001617\u3001618\u3001800\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5bf9\u7ecf\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u7684\u7528\u6237\u6267\u884c\u6b63\u786e\u7684\u6388\u6743\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u5347\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Enterprise Financial Services\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2021-18017\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP Enterprise Financial Services 101",
      "SAP Enterprise Financial Services 102",
      "SAP Enterprise Financial Services 103",
      "SAP Enterprise Financial Services 104",
      "SAP Enterprise Financial Services 105",
      "SAP Enterprise Financial Services 600",
      "SAP Enterprise Financial Services 603",
      "SAP Enterprise Financial Services 604",
      "SAP Enterprise Financial Services 605",
      "SAP Enterprise Financial Services 606",
      "SAP Enterprise Financial Services 616",
      "SAP Enterprise Financial Services 617",
      "SAP Enterprise Financial Services 618",
      "SAP Enterprise Financial Services 800"
    ]
  },
  "referenceLink": "https://vigilance.fr/vulnerability/SAP-multiple-vulnerabilities-of-March-2021-34786",
  "serverity": "\u4e2d",
  "submitTime": "2021-03-12",
  "title": "SAP Enterprise Financial Services\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2021-18017\uff09"
}

CVE-2021-21486 (GCVE-0-2021-21486)

Vulnerability from cvelistv5 – Published: 2021-03-09 14:07 – Updated: 2024-08-03 18:16

Summary

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

Missing Authorization check

Assigner

sap

References

URL

Tags

	https://wiki.scn.sap.com/wiki/pages/viewpage.acti…	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3007888	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAP SE	SAP Enterprise Financial Services (Bank Customer Accounts)	Affected: < 101 Affected: < 102 Affected: < 103 Affected: < 104 Affected: < 105 Affected: < 600 Affected: < 603 Affected: < 604 Affected: < 605 Affected: < 606 Affected: < 616 Affected: < 617 Affected: < 618 Affected: < 800

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:16:23.023Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3007888"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Enterprise Financial Services (Bank Customer Accounts)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 101"
            },
            {
              "status": "affected",
              "version": "\u003c 102"
            },
            {
              "status": "affected",
              "version": "\u003c 103"
            },
            {
              "status": "affected",
              "version": "\u003c 104"
            },
            {
              "status": "affected",
              "version": "\u003c 105"
            },
            {
              "status": "affected",
              "version": "\u003c 600"
            },
            {
              "status": "affected",
              "version": "\u003c 603"
            },
            {
              "status": "affected",
              "version": "\u003c 604"
            },
            {
              "status": "affected",
              "version": "\u003c 605"
            },
            {
              "status": "affected",
              "version": "\u003c 606"
            },
            {
              "status": "affected",
              "version": "\u003c 616"
            },
            {
              "status": "affected",
              "version": "\u003c 617"
            },
            {
              "status": "affected",
              "version": "\u003c 618"
            },
            {
              "status": "affected",
              "version": "\u003c 800"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing Authorization check",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-09T14:07:48",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3007888"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2021-21486",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Enterprise Financial Services (Bank Customer Accounts)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "101"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "102"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "103"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "104"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "105"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "600"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "603"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "604"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "605"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "606"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "616"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "617"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "618"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "800"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "6.8",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Missing Authorization check"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3007888",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3007888"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2021-21486",
    "datePublished": "2021-03-09T14:07:48",
    "dateReserved": "2020-12-30T00:00:00",
    "dateUpdated": "2024-08-03T18:16:23.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-18017

CVE-2021-21486 (GCVE-0-2021-21486)

Tags

Sightings

Nomenclature