CVE-2021-44232 (GCVE-0-2021-44232)

Vulnerability from cvelistv5 – Published: 2021-12-14 15:44 – Updated: 2024-08-04 04:17
VLAI?
Summary
SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.
Severity ?
No CVSS data available.
CWE
  • Path Traversal
Assigner
sap
References
Impacted products
Vendor Product Version
SAP SE SAF-T Framework Affected: < SAP_FIN 617
Affected: < 618
Affected: < 720
Affected: < 730
Affected: < SAP_APPL 600
Affected: < 602
Affected: < 603
Affected: < 604
Affected: < 605
Affected: < 606
Affected: < S4CORE 102
Affected: < 103
Affected: < 104
Affected: < 105
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:17:24.925Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3124094"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAF-T Framework",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c SAP_FIN 617"
            },
            {
              "status": "affected",
              "version": "\u003c 618"
            },
            {
              "status": "affected",
              "version": "\u003c 720"
            },
            {
              "status": "affected",
              "version": "\u003c 730"
            },
            {
              "status": "affected",
              "version": "\u003c SAP_APPL 600"
            },
            {
              "status": "affected",
              "version": "\u003c 602"
            },
            {
              "status": "affected",
              "version": "\u003c 603"
            },
            {
              "status": "affected",
              "version": "\u003c 604"
            },
            {
              "status": "affected",
              "version": "\u003c 605"
            },
            {
              "status": "affected",
              "version": "\u003c 606"
            },
            {
              "status": "affected",
              "version": "\u003c S4CORE 102"
            },
            {
              "status": "affected",
              "version": "\u003c 103"
            },
            {
              "status": "affected",
              "version": "\u003c 104"
            },
            {
              "status": "affected",
              "version": "\u003c 105"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-14T15:44:10",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3124094"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2021-44232",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAF-T Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "SAP_FIN 617"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "618"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "720"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "730"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "SAP_APPL 600"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "602"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "603"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "604"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "605"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "606"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "S4CORE 102"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "103"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "104"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "105"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3124094",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3124094"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2021-44232",
    "datePublished": "2021-12-14T15:44:10",
    "dateReserved": "2021-11-26T00:00:00",
    "dateUpdated": "2024-08-04T04:17:24.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:103:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"075F0C13-743C-4989-8E9F-9556C627B7F2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:104:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EC128E0D-BC7A-4BBB-9CF7-5C487B78637B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:105:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1BD00FEF-63F3-43C0-BEC1-7A90C48D403E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:602:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49BAD4FA-0687-4CFC-AD49-76CAAABEAC0F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:603:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF9E5BB1-C617-4E31-9BF7-E15CA1A72708\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:604:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E5CAB262-D04E-4382-8907-4524A1A45841\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:605:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E172D844-43B3-4215-8FA4-38432AE7468C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:606:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"572EC58C-FD48-4020-9DAE-A36458AA3AF0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:618:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"14947511-CDD0-470E-A80D-46BA8FCC6176\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:720:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ECDD7553-5E2A-4D21-A042-C1AA40707E3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:730:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"12B61A0B-9894-403A-ACA3-1E3781922B0D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:s4core_102:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0EB72F03-0FE0-46E8-A306-AAB6D39BF1FE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:sap_appl_600:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C97C61FF-F3DE-4FCE-B13D-2189896AAAFA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:saf-t_framework:sap_fin_617:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4F697A32-AF79-4A85-974A-AADB19F4E5B6\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.\"}, {\"lang\": \"es\", \"value\": \"SAF-T Framework Transaction SAFTN_G permite a un atacante explotar una comprobaci\\u00f3n insuficiente de la informaci\\u00f3n de la ruta proporcionada por el usuario normal, conllevando a un acceso completo al directorio del servidor. El atacante puede ver toda la estructura del sistema de archivos pero no puede sobrescribir, borrar o corromper archivos arbitrarios en el servidor\"}]",
      "id": "CVE-2021-44232",
      "lastModified": "2024-11-21T06:30:38.860",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 7.7, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.1, \"impactScore\": 4.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:N/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-12-14T16:15:09.623",
      "references": "[{\"url\": \"https://launchpad.support.sap.com/#/notes/3124094\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/3124094\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cna@sap.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-44232\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2021-12-14T16:15:09.623\",\"lastModified\":\"2024-11-21T06:30:38.860\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.\"},{\"lang\":\"es\",\"value\":\"SAF-T Framework Transaction SAFTN_G permite a un atacante explotar una comprobaci\u00f3n insuficiente de la informaci\u00f3n de la ruta proporcionada por el usuario normal, conllevando a un acceso completo al directorio del servidor. El atacante puede ver toda la estructura del sistema de archivos pero no puede sobrescribir, borrar o corromper archivos arbitrarios en el servidor\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"075F0C13-743C-4989-8E9F-9556C627B7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:104:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC128E0D-BC7A-4BBB-9CF7-5C487B78637B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:105:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BD00FEF-63F3-43C0-BEC1-7A90C48D403E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:602:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49BAD4FA-0687-4CFC-AD49-76CAAABEAC0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:603:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF9E5BB1-C617-4E31-9BF7-E15CA1A72708\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:604:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5CAB262-D04E-4382-8907-4524A1A45841\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:605:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E172D844-43B3-4215-8FA4-38432AE7468C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:606:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"572EC58C-FD48-4020-9DAE-A36458AA3AF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:618:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14947511-CDD0-470E-A80D-46BA8FCC6176\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:720:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECDD7553-5E2A-4D21-A042-C1AA40707E3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:730:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12B61A0B-9894-403A-ACA3-1E3781922B0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:s4core_102:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EB72F03-0FE0-46E8-A306-AAB6D39BF1FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:sap_appl_600:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C97C61FF-F3DE-4FCE-B13D-2189896AAAFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:saf-t_framework:sap_fin_617:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F697A32-AF79-4A85-974A-AADB19F4E5B6\"}]}]}],\"references\":[{\"url\":\"https://launchpad.support.sap.com/#/notes/3124094\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3124094\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.