fkie_nvd - fkie_cve-2021-44232

FKIE_CVE-2021-44232

Vulnerability from fkie_nvd - Published: 2021-12-14 16:15 - Updated: 2024-11-21 06:30

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.

References

URL	Tags
cna@sap.com	https://launchpad.support.sap.com/#/notes/3124094	Vendor Advisory
cna@sap.com	https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021	Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://launchpad.support.sap.com/#/notes/3124094	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021	Permissions Required, Vendor Advisory

Impacted products

Vendor	Product	Version
sap	saf-t_framework	103
sap	saf-t_framework	104
sap	saf-t_framework	105
sap	saf-t_framework	602
sap	saf-t_framework	603
sap	saf-t_framework	604
sap	saf-t_framework	605
sap	saf-t_framework	606
sap	saf-t_framework	618
sap	saf-t_framework	720
sap	saf-t_framework	730
sap	saf-t_framework	s4core_102
sap	saf-t_framework	sap_appl_600
sap	saf-t_framework	sap_fin_617

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:103:*:*:*:*:*:*:*",
              "matchCriteriaId": "075F0C13-743C-4989-8E9F-9556C627B7F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:104:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC128E0D-BC7A-4BBB-9CF7-5C487B78637B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:105:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BD00FEF-63F3-43C0-BEC1-7A90C48D403E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:602:*:*:*:*:*:*:*",
              "matchCriteriaId": "49BAD4FA-0687-4CFC-AD49-76CAAABEAC0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:603:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF9E5BB1-C617-4E31-9BF7-E15CA1A72708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:604:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5CAB262-D04E-4382-8907-4524A1A45841",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:605:*:*:*:*:*:*:*",
              "matchCriteriaId": "E172D844-43B3-4215-8FA4-38432AE7468C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:606:*:*:*:*:*:*:*",
              "matchCriteriaId": "572EC58C-FD48-4020-9DAE-A36458AA3AF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:618:*:*:*:*:*:*:*",
              "matchCriteriaId": "14947511-CDD0-470E-A80D-46BA8FCC6176",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:720:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECDD7553-5E2A-4D21-A042-C1AA40707E3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:730:*:*:*:*:*:*:*",
              "matchCriteriaId": "12B61A0B-9894-403A-ACA3-1E3781922B0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:s4core_102:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EB72F03-0FE0-46E8-A306-AAB6D39BF1FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:sap_appl_600:*:*:*:*:*:*:*",
              "matchCriteriaId": "C97C61FF-F3DE-4FCE-B13D-2189896AAAFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:sap_fin_617:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F697A32-AF79-4A85-974A-AADB19F4E5B6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server."
    },
    {
      "lang": "es",
      "value": "SAF-T Framework Transaction SAFTN_G permite a un atacante explotar una comprobaci\u00f3n insuficiente de la informaci\u00f3n de la ruta proporcionada por el usuario normal, conllevando a un acceso completo al directorio del servidor. El atacante puede ver toda la estructura del sistema de archivos pero no puede sobrescribir, borrar o corromper archivos arbitrarios en el servidor"
    }
  ],
  "id": "CVE-2021-44232",
  "lastModified": "2024-11-21T06:30:38.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-12-14T16:15:09.623",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3124094"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3124094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-44232 (GCVE-0-2021-44232)

Vulnerability from cvelistv5 – Published: 2021-12-14 15:44 – Updated: 2024-08-04 04:17

Summary

Severity ?

No CVSS data available.

CWE

Path Traversal

Assigner

sap

References

URL

Tags

	https://wiki.scn.sap.com/wiki/display/PSR/SAP+Sec…	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3124094	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAP SE	SAF-T Framework	Affected: < SAP_FIN 617 Affected: < 618 Affected: < 720 Affected: < 730 Affected: < SAP_APPL 600 Affected: < 602 Affected: < 603 Affected: < 604 Affected: < 605 Affected: < 606 Affected: < S4CORE 102 Affected: < 103 Affected: < 104 Affected: < 105

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:17:24.925Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3124094"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAF-T Framework",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c SAP_FIN 617"
            },
            {
              "status": "affected",
              "version": "\u003c 618"
            },
            {
              "status": "affected",
              "version": "\u003c 720"
            },
            {
              "status": "affected",
              "version": "\u003c 730"
            },
            {
              "status": "affected",
              "version": "\u003c SAP_APPL 600"
            },
            {
              "status": "affected",
              "version": "\u003c 602"
            },
            {
              "status": "affected",
              "version": "\u003c 603"
            },
            {
              "status": "affected",
              "version": "\u003c 604"
            },
            {
              "status": "affected",
              "version": "\u003c 605"
            },
            {
              "status": "affected",
              "version": "\u003c 606"
            },
            {
              "status": "affected",
              "version": "\u003c S4CORE 102"
            },
            {
              "status": "affected",
              "version": "\u003c 103"
            },
            {
              "status": "affected",
              "version": "\u003c 104"
            },
            {
              "status": "affected",
              "version": "\u003c 105"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-14T15:44:10",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3124094"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2021-44232",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAF-T Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "SAP_FIN 617"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "618"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "720"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "730"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "SAP_APPL 600"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "602"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "603"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "604"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "605"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "606"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "S4CORE 102"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "103"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "104"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "105"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "null",
            "vectorString": "null",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3124094",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3124094"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2021-44232",
    "datePublished": "2021-12-14T15:44:10",
    "dateReserved": "2021-11-26T00:00:00",
    "dateUpdated": "2024-08-04T04:17:24.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2021-44232

CVE-2021-44232 (GCVE-0-2021-44232)

Tags

Sightings

Nomenclature